CVE-2026-90711

Executive Summary

CVE-2026-90711 is a fail-open trust-evaluation flaw in proxy-addr, the Node.js module that resolves a request's client IP behind reverse proxies and backs Express req.ip and req.ips. Versions 1.1.0 through 2.0.7 silently accept an IPv4-mapped IPv6 trust subnet written with an IPv4-sized prefix (e.g. ::ffff:10.0.0.0/8 instead of /104), causing the module to trust every IPv4 address on the internet. Because the socket peer is then trusted at hop 0, any unauthenticated remote client can forge X-Forwarded-For and dictate the address the application observes, defeating IP allowlists, rate limiting, geolocation, and audit logging. The issue is rated CVSS 9.1 (Critical) and is fixed in proxy-addr 2.0.8.

Technical Analysis

proxy-addr determines the client address of an HTTP request when the application sits behind one or more reverse proxies. It exports a function that accepts a trust argument — commonly sourced from Express's trust proxy setting — which may be a boolean, a preset string, a list of addresses, or a list of CIDR subnets. On each request the module walks the X-Forwarded-For header from the socket peer backward, and as long as each hop address falls inside the configured trust list, it continues to trust successive entries. The final trusted address is returned as the client IP.

The flaw is a CWE-290 (Authentication Bypass by Spoofing) condition created by a fail-open regression introduced in version 1.1.0. When a trust subnet is expressed in IPv4-mapped IPv6 notation (::ffff:a.b.c.d) but carries an IPv4-sized prefix (e.g. /8, /16, /24), the parser does not reject the entry. Instead of evaluating the prefix against the 128-bit address space as written, the entry is effectively broadened such that the resulting trust range encompasses all IPv4 addresses. The description explicitly states this trusts "every IPv4 address on the internet rather than the block it names." The correct prefix for an IPv4-mapped block is at least 97 bits (each mapped IPv4 octet occupies 8 bits within the final 32 bits of the IPv6 address): ::ffff:10.0.0.0/8 should have been written ::ffff:10.0.0.0/104, or simply 10.0.0.0/8.

The security consequence is chained: once the trust range is over-broad, the socket peer itself is treated as a trusted hop (hop 0). This means the module begins trusting client-supplied forwarding headers from an untrusted origin. Any unauthenticated client can therefore inject an arbitrary X-Forwarded-For value, and proxy-addr — and by extension Express req.ip/req.ips — will report that attacker-chosen value as the client address.

Because proxy-addr is a transitive dependency of Express and a wide ecosystem of Node.js middleware, the blast radius extends to any application that (a) uses proxy-addr / Express trust proxy, and (b) relies on the resolved client IP for security decisions. Notably, the misconfiguration is silent: the malformed CIDR does not raise an error, so operators have no indication their trust boundary has collapsed. The vulnerability is network-reachable (AV:N), requires no privileges (PR:N) and no user interaction (UI:N), and has low attack complexity (AC:L), yielding the Critical base score of 9.1. Confidentiality and Integrity impacts are High (H) because the spoofed identity flows into downstream authorization, logging, and rate-limiting logic; Availability is Not impacted (A:N).

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is currently available for CVE-2026-90711. The attack chain below is inferred safely from the documented vulnerability class (trust-evaluation spoofing) and the NVD description; it does not rely on any fabricated function names, endpoints, or parameters beyond those stated.

1. Reconnaissance / target identification. An attacker identifies a Node.js/Express application deployed behind a reverse proxy that uses proxy-addr and has configured a mistrust of client-controlled forwarding headers using an IPv4-mapped IPv6 CIDR with an IPv4-sized prefix (for example ::ffff:10.0.0.0/8). This misconfiguration is often present in hardened-looking deployments: operators believe they are whitelisting an internal RFC1918 range while actually broadening trust to all IPv4 space. Fingerprinting the stack (e.g. X-Powered-By: Express) and observing whether the operator documents "trusted proxy" behavior helps identify candidates, but the vulnerable configuration is not externally announced — it must be inferred or found via leaked configuration.

2. Triggering the flaw class. The attacker sends an HTTP request to the public-facing reverse proxy that includes a client-controlled forwarding header. Because the misconfigured trust range now treats the socket peer as a trusted hop 0, the module accepts the attacker-supplied X-Forwarded-For value. The flaw is triggered simply by the presence of a forged header in a request to a service with the over-broad trust configuration — no special payload encoding is required beyond supplying the header.

3. Payload / execution method (vulnerability-class level). Using standard HTTP tooling, the attacker sets X-Forwarded-For to a value within any IP range the application treats as privileged — for example an internal address, a "loopback" value, or an address on an application's administrative allowlist. Multiple comma-separated hops may be supplied, since the module walks the header chain; the attacker can shape the resulting req.ip/req.ips by choosing header values. No memory-corruption or code-execution payload is involved; the "payload" is the forged header itself.

4. Post-exploitation impact. With the application trusting the forged address, the attacker can: bypass IP-based access control (reach administrative or internal-only routes gated on source IP); evade per-IP rate limiting (rotate to fresh forged addresses to defeat throttles); poison geolocation/abuse logic that keys off client IP; and corrupt audit logs, since the recorded client address is now attacker-controlled, degrading incident response and attribution. In environments where the resolved IP feeds session or fraud logic, the integrity impact extends further. None of these steps require credentials, confirming the NULL-privilege, network-reachable profile of the CVSS 9.1 score.

Impact Assessment

The vulnerability applies to any Node.js deployment using proxy-addr 1.1.0–2.0.7 (directly or via Express) with a trust list that includes an IPv4-mapped IPv6 subnet using an IPv4-sized prefix. Upgrading to proxy-addr 2.0.8 resolves the flaw. The CVSS 3.1 subscores confirm the severity profile:

• AV:N (Network) — exploitation is possible remotely over the network; no local access required.
• AC:L (Low) — no special conditions; a forged header is sufficient, and the malformed configuration is accepted without error.
• PR:N (None) — no authentication or prior access needed; any unauthenticated client qualifies.
• UI:N (None) — no user interaction is required.
• S:U (Unchanged) — the impact remains within the security scope of the vulnerable component.
• C:H / I:H — the attacker can read or misrepresent identity-dependent data and manipulate downstream security decisions (access control, logging, rate limiting).
• A:N — no loss of availability is inherent to the flaw.

Business impact: Defeated IP allowlisting can expose internal-only or administrative functionality to the internet. Corrupted audit trails directly undermine compliance (e.g. audit-log integrity requirements) and incident forensics, because the recorded client source is untrustworthy. Rate-limit and anti-abuse bypass enables credential stuffing, scraping, and resource abuse at scale. Blast radius: because proxy-addr is a ubiquitous Express transitive dependency, the number of installed instances is large, but actual exposure is scoped to those with a vulnerable trust configuration — meaning the true exploitable cohort is a subset defined by operator misconfiguration rather than all installs. EPSS is 0.00187 (8.5th percentile), indicating low predicted near-term exploitation activity; CISA KEV does not list this CVE, so no confirmed in-the-wild exploitation is documented at this time.

Detection Guidance

Detection focuses on anomalous X-Forwarded-For / X-Real-IP handling and on the application-observed client address diverging from the socket peer. Because there is no code-execution signature, detection is inherently behavioral and log-centric. The rules below are illustrative scaffolding for environments that log forwarding headers and proxy behavior; tune field names and log sources to the local schema.

Sigma Rule

title: Potential proxy-addr Trust Bypass via Forged X-Forwarded-For
id: 5f2c9a1e-9071-4b6d-9c31-proxyaddr001
status: experimental
description: Detects HTTP requests where X-Forwarded-For is present on a connection whose originating socket is an external/untrusted peer, indicating possible client-IP spoofing against a misconfigured proxy-addr trust list (CVE-2026-90711).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-90711
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_header:
    cs-header|xcontains:
      - 'X-Forwarded-For:'
      - 'x-forwarded-for:'
  selection_external_peer:
    src_ip|cidr:
      - '0.0.0.0/0'
  filter_trusted_proxy:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_header and selection_external_peer and not filter_trusted_proxy
falsepositives:
  - Legitimate reverse proxies that are not in the internal CIDR filter list
  - Client networks that legitimately set X-Forwarded-For
level: medium
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.90711

YARA Rule

rule CVE_2026_90711_proxyaddr_ipv4mapped_misconfig
{
    meta:
        description = "Detects potentially vulnerable proxy-addr trust configuration using IPv4-mapped IPv6 CIDR with an IPv4-sized prefix (e.g. ::ffff:10.0.0.0/8) in Node.js config, source, or package files."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90711"
        date = "2026-01-01"
        severity = "high"

    strings:
        $mapped = "::ffff:" ascii nocase
        $trust1 = "trust proxy" ascii nocase
        $trust2 = "trustProxy" ascii nocase
        $app  = "proxy-addr" ascii nocase
        $pkg  = "\"express\"" ascii nocase

    condition:
        filesize < 2MB and
        $mapped and
        ( $trust1 or $trust2 or $app or $pkg )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-90711 Possible proxy-addr Trust Bypass via client-controlled X-Forwarded-For"; flow:established,to_server; http.header; content:"X-Forwarded-For"; nocase; http.header; pcre:"/X-Forwarded-For:\s*(127\.0\.0\.1|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)/i"; classtype:attempted-admin; reference:cve,2026-90711; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-90711; sid:202690711; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.transport == "tcp" and destination.port in (80, 443) ]
  [ http where http.request.headers.x_forwarded_for != null and
      not cidrmatch(source.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16") ]

Splunk SPL Query

index=proxy OR index=web sourcetype=access_combined
| eval xff=coalesce(x_forwarded_for, xff)
| where isnotnull(xff)
| eval socket_peer=src_ip
| where NOT cidrmatch(socket_peer, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
| stats count min(_time) as first_seen max(_time) as last_seen values(xff) as forged_values by socket_peer clientip uri_path
| where count > 5
| sort - count
| table first_seen last_seen socket_peer clientip uri_path count forged_values

Wazuh OSSEC Rule

<group name="web,proxy,cve-2026-90711,">
  <rule id="100711" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>X-Forwarded-For</match>
    <description>CVE-2026-90711: Possible client-IP spoofing via forged X-Forwarded-For against misconfigured proxy-addr/Express trust proxy</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack_initial_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — a single source, OSV, claims the fix; not independently confirmed). Treat the upgrade target as advisory-verified but validate against the official changelog before wide rollout.

1. Immediate mitigations (no code change required):

   • Audit every trust / trust proxy configuration for CIDRs written in IPv4-mapped IPv6 notation (::ffff:a.b.c.d).
   • Ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97 (for a full IPv4-mapped range use /96+octet-aligned values; for specific IPv4 subnets the correct prefix must be 96 + <IPv4 prefix bits>, e.g. /104 for a /8 IPv4 block).
   • Alternatively, express the range in plain IPv4 notation (e.g. 10.0.0.0/8) to eliminate the mapping ambiguity entirely.
   • Until patched, avoid relying on proxy-addr-derived client IPs for security-critical decisions; enforce access control and rate limiting at an upstream layer that validates the socket peer directly.

2. Patch / upgrade steps:

   • Upgrade the proxy-addr dependency to 2.0.8 or later.
   • Where Express is used, upgrade the Express version that pins a fixed proxy-addr (or pin/override the transitive dependency via overrides in package.json / npm dedupe) and regenerate the lockfile.
   • Re-run the application's full test suite against the new validation behavior; verify that previously accepted malformed CIDRs are now rejected or bounded correctly.

3. Long-term hardening:

   • Adopt a positive allowlist of trusted proxy addresses rather than broad subnet trust; validate configuration values at deploy time (reject IPv4-mapped IPv6 CIDRs with IPv4-sized prefixes).
   • Add configuration-as-code linting that fails builds on ambiguous IPv4/IPv6 trust entries.
   • Ensure audit logs record both the socket peer and the resolved client address so spoofing is visible during forensics.
   • Track dependency versions with SCA tooling and subscribe to security advisories for the Node.js ecosystem.

References

1. NVD — CVE-2026-90711: https://nvd.nist.gov/vuln/detail/CVE-2026-90711
2. OSV — advisory/patch source claiming fix in proxy-addr 2.0.8: https://osv.dev/
3. proxy-addr upstream project (jshttp) — changelog and 2.0.8 release notes
4. Express documentation — trust proxy setting and req.ip / req.ips behavior
5. CWE-290 — Authentication Bypass by Spoofing: https://cwe.mitre.org/data/definitions/290.html

Threat actor / exploitation status: No public Proof-of-Concept, exploit code, or Nuclei template is known. EPSS is 0.00187 (8.5th percentile), and CISA KEV does not list this CVE — no confirmed in-the-wild exploitation or attribution to a named threat actor campaign at the time of writing. Exploitation risk is nevertheless elevated for misconfigured deployments given the low complexity and NULL-privilege, network-reachable attack profile.