Executive brief
proxy-addr is a Node.js module used by Express to determine a client's real IP address when behind reverse proxies by validating X-Forwarded-For headers. A misconfiguration bug allows attackers to supply arbitrary IP addresses in X-Forwarded-For headers without authentication, bypassing IP-based access controls, rate limiting, and audit logging—defeating core security controls that many applications rely on.
Technical details
The vulnerability is an incorrect comparison (CWE-697) in how proxy-addr validates IPv4-mapped IPv6 trust subnets. When a subnet is configured in IPv4-mapped IPv6 notation with an insufficient prefix length (e.g., ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104), the module accepts it without error but trusts every IPv4 address on the internet rather than the intended block. The same issue affects IPv6 subnets with zero leading bits (e.g., ::/1). Because the socket peer becomes trusted at hop 0, unauthenticated clients can supply arbitrary X-Forwarded-For headers to spoof their IP address. No authentication is required; the attack is network-reachable. The vulnerability was introduced in version 1.1.0 and is fixed in 2.0.8, where IPv4 addresses now match an IPv6 trust subnet only when that subnet is a genuine IPv4-mapped subnet whose prefix covers the mapped marker.
Affected products
- jshttp proxy-addr 1.1.0 through 2.0.7
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched: proxy-addr 2.0.8 released