EUVD-2026-80806Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Once the erroneous trust subnet is configured, an unauthenticated remote attacker trivially spoofs client IP (PR:N/AC:L); access-control bypass yields C:H/I:H, no availability impact; config precondition is not modeled in base metrics.
Primary rating from Vendor (openjs).
CVSS VectorVendor: openjs
Lifecycle Timeline
5DescriptionCVE.org
@fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request.ips. In versions 3.0.0 through 5.1.0, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads, which defeats IP-based access control, rate limiting, geolocation, and audit logging. The plugin inherited this defect from the upstream proxy-addr module (CVE-2026-90711). The issue is fixed in @fastify/proxy-addr 5.1.1, and users should upgrade to 5.1.1 or later. As a workaround, ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.
AnalysisAI
IP spoofing in @fastify/proxy-addr 3.0.0 through 5.1.0 allows any unauthenticated remote client to control the client address an application believes it received, defeating IP-based access control, rate limiting, geolocation, and audit logging. The flaw is triggered only under a specific operator misconfiguration: a trusted-proxy subnet expressed in IPv4-mapped IPv6 notation with an IPv4-sized prefix (for example ::ffff:10.0.0.0/8) is silently accepted but expands to trust every IPv4 address, making the socket peer trusted at hop 0 so an attacker-supplied X-Forwarded-For header is honored. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires @fastify/proxy-addr version 3.0.0 through 5.1.0 AND a specific operator misconfiguration: a trust subnet written in IPv4-mapped IPv6 notation using an IPv4-sized prefix (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) presents this as a critical remote, unauthenticated trust-boundary bypass, and the vector is internally consistent with the description: any Internet client can spoof X-Forwarded-For once the flaw is triggered. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to @fastify/proxy-addr 5.1.1 or later (vendor-released patch, per advisory GHSA-8cmm-mhw6-v7xq); no patched release exists for the 3.x or 4.x lines, so staying on those branches requires the configuration workaround rather than a version bump. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Node.js service using @fastify/proxy-addr 3.0.0 through 5.1.0, and inspect the trustProxy / trusted-proxy configuration for IPv4-mapped IPv6 entries with IPv4-sized prefixes such as ::ffff:10.0.0.0/8 or ::ffff:192.168.0.0/16; where found, immediately rewrite them in native IPv4 CIDR notation (for example 10.0.0.0/8) or restrict them to the exact proxy host addresses, and treat any client IP recorded since deployment of the bad configuration as untrusted for audit and access-control purposes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a bi
crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial
Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PH
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today