{"action":"Upgrade proxy-addr to 2.0.8 or later.","affected":[{"fixed":"2.0.8","introduced":"1.1.0"}],"component":"proxy-addr","cve_ids":["CVE-2026-90711"],"ecosystem":"npm","epss":0.0026,"exploited":false,"fixed_versions":["2.0.8"],"ghsa_id":"GHSA-jqcg-44mw-7w3h","id":"tcs_01M5KFYN6C273JJRMZF6Y2SY8K","modified_at":"2026-10-05T23:45:07.322157228Z","published_at":"2026-10-05T23:30:26Z","references":["https://osv.dev/vulnerability/GHSA-jqcg-44mw-7w3h","https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h","https://nvd.nist.gov/vuln/detail/CVE-2026-90711","https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965","https://cna.openjsf.org/security-advisories.html","https://github.com/jshttp/proxy-addr","https://github.com/jshttp/proxy-addr/releases/tag/v2.0.8"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-jqcg-44mw-7w3h","url":"https://osv.dev/vulnerability/GHSA-jqcg-44mw-7w3h"}],"summary":"proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet"}