CVE-2026-92395

Executive Summary

CVE-2026-92395 is a high-severity (CVSS 9.1) trust-boundary bypass in the @fastify/proxy-addr plugin, which underpins request.ip and request.ips in Fastify applications deployed behind reverse proxies. In versions 3.0.0 through 5.1.0, an IPv4-mapped IPv6 trust subnet declared with an IPv4-sized prefix (e.g., ::ffff:10.0.0.0/8 instead of ::ffff:10.0.0.0/104) is silently accepted and causes the plugin to trust every IPv4 address on the internet. This allows any unauthenticated remote client to spoof its source address via the X-Forwarded-For header, defeating IP-based access control, rate limiting, geolocation, and audit logging. The defect is inherited from the upstream proxy-addr module (CVE-2026-90711) and is fixed in @fastify/proxy-addr 5.1.1.

Technical Analysis

The vulnerability class is trust-boundary misconfiguration resulting from subnet-prefix misinterpretation (CWE-290: Authentication Bypass by Spoofing). The upstream proxy-addr module, which @fastify/proxy-addr inherits from, is responsible for computing a request's client address by walking a chain of trusted proxies. It maintains a list of trusted subnets and, for each hop, determines whether the immediate socket peer is trusted.

The defect arises when a trust subnet is expressed in IPv4-mapped IPv6 notation (the ::ffff:0:0/96 range that embeds IPv4 addresses) but is paired with a prefix length intended for plain IPv4. An IPv4-mapped IPv6 address consumes 96 bits of the 128-bit IPv6 space to encode the ::ffff: prefix, leaving only 32 bits for the embedded IPv4 address. Therefore, the correct prefix length for ::ffff:10.0.0.0/8 semantics (the RFC 1918 10.0.0.0/8 block) is /104 (96 + 8). When an operator instead writes ::ffff:10.0.0.0/8, the module interprets the /8 as applying to the raw IPv6 representation rather than the embedded IPv4 portion. The result is that the subnet matches all addresses in the ::ffff:0:0/96 range — i.e., the entire 0.0.0.0/0 IPv4 internet.

Because the socket peer of any connecting client now falls within this overly broad "trusted" range, it is treated as trusted at hop 0. The plugin consequently accepts the client-supplied X-Forwarded-For header as authoritative for the client address, rather than ignoring it or appending to it. An attacker can therefore place an arbitrary IP address in X-Forwarded-For and have the application's request.ip / request.ips reflect that spoofed value. No authentication is required, and no error is emitted when the misconfigured subnet is loaded — the security failure is silent.

The upstream defect is tracked as CVE-2026-90711; CVE-2026-92395 is the Fastify plugin's inherited instance of the same flaw. It is fixed in @fastify/proxy-addr 5.1.1.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-92395. The attack chain below is inferred strictly from the NVD description and vulnerability class.

1. Reconnaissance / target identification. An attacker identifies a Fastify application that relies on request.ip or request.ips for security decisions and is fronted by a reverse proxy. Tells include X-Forwarded-For processing behavior or Fastify server banners. The attacker needs no credentials and no knowledge of internal topology — only that the target accepts connection from the internet.

2. Triggering the flaw class. The attacker sends an HTTP request directly to the application (or via a proxy that permits header pass-through) with a crafted X-Forwarded-For header. Because the misconfigured trust subnet (::ffff:<block>/<IPv4-prefix>) causes the socket peer to be trusted at hop 0, the plugin accepts the attacker-supplied header value as the client address. The vulnerability is triggered by the configuration state of the trust list, not by a malformed payload; the attacker merely supplies an arbitrary X-Forwarded-For value in a normal request.

3. Payload / execution method (vulnerability-class level). The "payload" is the spoofed address string placed in X-Forwarded-For — for example, an address inside a protected range (such as 127.0.0.1 or an internal allowlisted block). The attacker selects a value that satisfies whatever downstream authorization check the application performs against request.ip. This is an address-spoofing primitive, not memory corruption or code execution.

4. Post-exploitation impact. With a controllable client address, the attacker can bypass IP allowlists (e.g., admin-only or internal-only endpoints), evade per-IP rate limiting, falsify geolocation-based decisions, and poison audit logs / security analytics with arbitrary source addresses. The CVSS vector reflects High confidentiality and High integrity impact with no availability impact (C:H/I:H/A:N), consistent with access-control bypass and log/telemetry manipulation.

Impact Assessment

CVSS:3.1 base score 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Attack complexity is Low and no privileges or user interaction are required, because the flaw is activated by an existing misconfiguration and abused with a single unauthenticated request. Scope is Unchanged (impact remains within the vulnerable component's trust domain). Confidentiality and Integrity are High: bypassing IP-based controls can expose protected functionality and data, while spoofable audit logs undermine forensic integrity. Availability is None.

Blast radius spans any Fastify deployment (versions 3.0.0–5.1.0 of @fastify/proxy-addr) that (a) uses trust subnets written in IPv4-mapped IPv6 notation with IPv4-sized prefixes and (b) relies on request.ip / request.ips for security controls. Because the plugin backs core Fastify request properties, the affected surface includes authentication gates keyed to source IP, WAF/rate-limit tiers, geolocation features, and downstream audit pipelines. Internet-facing applications are at greatest risk given network reachability (AV:N).

Detection Guidance

Sigma Rule

title: Suspicious X-Forwarded-For Spoofing Against Fastify proxy-addr
id: 7f3a1c2e-9b4d-4e21-a6c8-2d5f0e93b7a1
status: experimental
description: Detects requests carrying private/loopback addresses in X-Forwarded-For headers, indicative of source-address spoofing abuse against applications relying on @fastify/proxy-addr request.ip.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92395
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: fastify
detection:
  selection_hdr:
    cs-header|contains:
      - 'X-Forwarded-For: 127.'
      - 'X-Forwarded-For: 10.'
      - 'X-Forwarded-For: 192.168.'
      - 'X-Forwarded-For: 172.16.'
  condition: selection_hdr
falsepositives:
  - Legitimate proxy chains that genuinely originate from internal ranges
level: medium
tags:
  - attack.t1190
  - cve.2026.92395

YARA Rule

rule CVE_2026_92395_Fastify_ProxyAddr_Misconfig
{
    meta:
        description = "Detects IPv4-mapped IPv6 trust subnet misconfiguration in Fastify proxy-addr config (IPv4-sized prefix on ::ffff: range)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92395"
        date = "2026-01-01"
        severity = "high"
    strings:
        $mapped = "::ffff:" ascii
        $plugin1 = "@fastify/proxy-addr" ascii
        $plugin2 = "proxy-addr" ascii
        $trust = "trust" ascii nocase
        $sl8  = "/8" ascii
        $sl16 = "/16" ascii
        $sl24 = "/24" ascii
    condition:
        $mapped and $plugin1 and $trust and any of ($sl8, $sl16, $sl24)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92395 Fastify proxy-addr X-Forwarded-For spoofing attempt"; flow:established,to_server; http.header; content:"X-Forwarded-For"; nocase; pcre:"/X-Forwarded-For:\s*(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)/Hi"; reference:cve,2026-92395; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-92395; classtype:attempted-recon; sid:202692395; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where http.request.headers.x_forwarded_for : "127.*" or
                  http.request.headers.x_forwarded_for : "10.*" or
                  http.request.headers.x_forwarded_for : "192.168.*"]

Splunk SPL Query

index=web
| search "X-Forwarded-For"
| rex field=_raw "(?i)X-Forwarded-For:\s*(?<xff_addr>[0-9a-fA-F:\.]+)"
| where match(xff_addr, "^(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|::ffff:)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, xff_addr, uri_path
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="web,fastify,cve_2026_92395,">
  <rule id="202692395" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>X-Forwarded-For</match>
    <regex offset="after_parent">X-Forwarded-For:\s*(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)</regex>
    <description>CVE-2026-92395: Possible Fastify proxy-addr client IP spoofing via X-Forwarded-For header</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_92395,attempted_recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED per tracked sources; however the NVD description explicitly states the issue is fixed in @fastify/proxy-addr 5.1.1. Treat the 0/4 as reflecting absence of independently verified patch evidence from tracked sources.

1. Immediate mitigations.

   • Audit all trust subnet configurations for entries in ::ffff: notation with an IPv4-sized prefix. Either express ranges in plain IPv4 notation (e.g., 10.0.0.0/8) or use a prefix length of at least 97 for IPv4-mapped IPv6 subnets (e.g., ::ffff:10.0.0.0/104 for 10.0.0.0/8).
   • Where request.ip is used for security decisions, add compensating controls: application-layer authentication independent of source IP, and validation that trusted proxy hops match expected topology.

2. Patch / upgrade steps. Upgrade the @fastify/proxy-addr dependency to 5.1.1 or later. Confirm transitive resolution via your lockfile, and re-test trust configuration after upgrade.

3. Long-term hardening.

   • Adopt infrastructure-as-code linting that rejects IPv4-sized prefixes on IPv4-mapped IPv6 subnets.
   • Avoid relying solely on request.ip/request.ips for authorization; layer rate limiting and authentication at the edge (proxy/WAF).
   • Monitor upstream advisories for the related proxy-addr CVE-2026-90711 and Fastify plugin releases.

References

• NVD — CVE-2026-92395: https://nvd.nist.gov/vuln/detail/CVE-2026-92395
• Upstream defect — CVE-2026-90711 (proxy-addr module): https://nvd.nist.gov/vuln/detail/CVE-2026-90711
• @fastify/proxy-addr package: https://www.npmjs.com/package/@fastify/proxy-addr
• proxy-addr upstream module: https://www.npmjs.com/package/proxy-addr
• Fix version — @fastify/proxy-addr 5.1.1 (per NVD description). CISA KEV: not listed. No threat-actor campaign or exploit-in-the-wild evidence is available at time of writing; EPSS not yet scored by FIRST.org.