CVE-2026-90711
1 advisory.
npm/proxy-addr CVE-2026-90711: critical 9.1
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
Action: Upgrade proxy-addr to 2.0.8 or later.
npm i proxy-addr@2.0.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.1.0 | 2.0.8 | - |
Fixed versions
| 2.0.8 |
Sources
- osv: GHSA-jqcg-44mw-7w3h
- https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h
- https://nvd.nist.gov/vuln/detail/CVE-2026-90711
- https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965
- https://cna.openjsf.org/security-advisories.html
- https://github.com/jshttp/proxy-addr
- https://github.com/jshttp/proxy-addr/releases/tag/v2.0.8
CVE-2026-90711 · published · modified · JSON