Description

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This is a fail-open regression introduced in version 1.1.0. The issue is fixed in proxy-addr 2.0.8, and users should upgrade to 2.0.8 or later. As a workaround, ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-15T07:16:33.683Z",
  "pubdate": "2026-09-15T07:16:33.683Z",
  "executiveSummary": "The Node.js module proxy-addr contains a critical vulnerability regarding the parsing of IPv4-mapped IPv6 CIDR notations. This flaw allows a misconfigured trust subnet definition to inadvertently trust all IPv4 addresses globally, rather than the intended restricted range. Affected versions include 1.1.0 through 2.0.7. The vulnerability enables unauthenticated remote attackers to perform IP spoofing by injecting arbitrary X-Forwarded-For headers. By bypassing IP-based access controls, rate limiting, and audit logging mechanisms, an attacker can masquerade as a trusted entity, leading to unauthorized access to restricted application features, exhaustion of rate-limited resources, or obfuscation of malicious activity in system logs. The failure to correctly validate prefix lengths for IPv4-mapped addresses creates a 'fail-open' security posture, significantly expanding the attack surface for any application relying on proxy-addr for request identity verification in proxied environments.",
  "technicalDetails": "The vulnerability resides in how proxy-addr processes trust subnets defined using the IPv4-mapped IPv6 address format (e.g., ::ffff:10.0.0.0). When a subnet is specified with an incorrect prefix length, the logic fails to enforce valid boundary checks. Specifically, providing a prefix length smaller than the 96-bit prefix required for IPv4-mapped addresses (such as using /8 instead of the correct /104) causes the underlying calculation to interpret the range as inclusive of all IPv4 addresses. This logic error effectively ignores the intended restriction, resulting in every incoming IPv4 connection being flagged as a 'trusted' source at hop 0.\nThe exploitation flow begins when an administrator configures proxy-addr with a malformed trust subnet, such as '::ffff:10.0.0.0/8'. Because the library does not reject this configuration, the system incorrectly trusts any IP address originating from the socket peer. An unauthenticated attacker can then issue an HTTP request containing an arbitrary 'X-Forwarded-For' header. Since the application believes the incoming request originated from a trusted reverse proxy, it trusts the contents of the 'X-Forwarded-For' header to determine the 'real' client IP address, as exposed by Express via 'req.ip' or 'req.ips'.\nThis allows the attacker to manipulate the identity seen by the application logic. If an application uses this IP for authentication bypass, rate limiting, or security policy enforcement, the attacker can spoof trusted IPs (e.g., local network addresses or administrative IPs) to bypass security controls. Post-exploitation impact includes the successful subversion of IP-based authentication, the ability to bypass brute-force protection mechanisms, and the corruption of forensic audit trails, as logs will record the attacker-supplied, spoofed IP address rather than the true source IP. The vulnerability persists until an explicit upgrade or configuration change is applied to ensure that the prefix length correctly reflects the intended network mask for the IPv4-mapped address space, typically requiring a prefix length of at least 97."
}