proxy-addr CVE-2026-90711

Requires the target application to use proxy-addr 1.1.0-2.0.7 with a trusted-proxy subnet expressed in IPv4-mapped IPv6 notation using an IPv4-sized prefix (e.g. ::ffff:10.0.0.0/8 rather than /104) - this specific, non-default misconfiguration is the exact enabling condition; correctly written subnets or plain IPv4 notation are NOT affected. When present, no further conditions apply: exploitation is remote, unauthenticated (PR:N), needs no user interaction, and works against any client because the socket peer is trusted at hop 0 and can set an arbitrary X-Forwarded-For header. The primary limiter is thus the presence of the flawed trust-subnet configuration, not attacker capability.

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) treats this as a trivially exploitable remote unauthenticated flaw, which is accurate ONLY once the vulnerable configuration exists. The decisive limiting factor - not reflected in AC:L - is that exploitation requires the operator to have written a trust subnet in IPv4-mapped IPv6 notation with an IPv4-sized prefix; default and correctly-configured deployments are unaffected. I therefore assess attack complexity as high (AC:H) because a specific, non-default misconfiguration must be present. No EPSS score was provided, there is no POC referenced, and it is not KEV-listed, so there is no evidence of active or automated exploitation; the priority is driven by proxy-addr's enormous deployment footprint rather than by observed attacks. Where the misconfiguration does exist, real impact is severe and reliably reachable: complete bypass of IP-based access control, rate limiting, geofencing, and trustworthy audit logging.

An Express app behind a proxy uses 'trust proxy' set to ::ffff:10.0.0.0/8 to trust its internal network; because proxy-addr treats this as trusting all IPv4, the attacker's own connection is trusted at hop 0. The attacker sends a normal HTTP request with a spoofed header such as 'X-Forwarded-For: 10.0.0.5' (or an allowlisted admin IP), and the application reads that forged value as req.ip, bypassing IP allowlists and rate limits and poisoning audit logs. No authentication or user interaction is needed once the misconfiguration is present; no public exploit is currently identified, so the attack would be hand-crafted.