Fastify proxy-addr CVE-2026-92395

Requires @fastify/proxy-addr version 3.0.0 through 5.1.0 AND a specific operator misconfiguration: a trust subnet written in IPv4-mapped IPv6 notation using an IPv4-sized prefix (e.g. ::ffff:10.0.0.0/8) rather than the mapped-space equivalent (/104). Under that condition the misconfigured range silently expands to trust all IPv4 addresses, so any unauthenticated remote client can spoof X-Forwarded-For to control request.ip/request.ips. Deployments that express trust ranges in plain IPv4 notation, use a prefix length of at least 97 for mapped ranges, or do not use trusted-proxy IP handling are NOT affected - this misconfiguration precondition is the primary factor limiting real-world exposure despite the unauthenticated network attack path.

The vendor CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) presents this as a critical remote, unauthenticated trust-boundary bypass, and the vector is internally consistent with the description: any Internet client can spoof X-Forwarded-For once the flaw is triggered. However, a crucial gating factor is NOT captured in the CVSS base score - exploitation requires the operator to have written a trust subnet in IPv4-mapped IPv6 notation with an IPv4-sized prefix (e.g. ::ffff:10.0.0.0/8 instead of the correct /104). This is an operator misconfiguration precondition, so real-world exposure is limited to deployments that both use @fastify/proxy-addr 3.0.0-5.1.0 AND configured trust ranges in that specific erroneous form. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no signal of active or imminent exploitation - this is a real, high-impact configuration-dependent weakness rather than a confirmed mass-exploited threat. The C:H/I:H rating is defensible because bypassing IP-based access control can expose IP-gated admin endpoints (confidentiality) and enable spoofed/forged actions and poisoned audit logs (integrity); A:N is correct as no availability impact is described. Note the shared root cause with upstream proxy-addr CVE-2026-90711 means the true footprint of the class is broader than this Fastify plugin alone.

An operator configures @fastify/proxy-addr to trust an internal range but writes it as ::ffff:10.0.0.0/8, which is silently accepted and effectively trusts every IPv4 address on the Internet. An unauthenticated remote attacker then sends a request with a forged X-Forwarded-For header, and because their socket peer is treated as trusted at hop 0, the application reads the attacker-chosen address for request.ip - bypassing IP allowlists, rate limits, geolocation, and audit logging. No public exploit code is identified, but the technique is trivial (a single crafted HTTP header).