Executive brief
@fastify/proxy-addr is a Fastify plugin that determines a user's real IP address when applications sit behind reverse proxies, enabling IP-based access controls and logging. When misconfigured with certain IPv6 address formats, the plugin incorrectly trusts all IPv4 clients, allowing attackers to forge their source IP and bypass security controls like rate limiting, geolocation restrictions, and audit trails.
Technical details
The vulnerability is an incorrect comparison/parsing issue (CWE-697, CWE-348) in how IPv4-mapped IPv6 CIDR blocks are validated. When a trust subnet is written as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, the subnet compiles to match all IPv4 addresses rather than the intended /8 block. Similarly, zero-leading-bit IPv6 subnets like ::/1 are incorrectly trusted. An unauthenticated remote attacker can then supply an arbitrary X-Forwarded-For header, and the plugin will return that spoofed address as the client IP (via proxyaddr(req, trust), request.ip, or request.ips). This defeats IP-based access control, rate limiting, geolocation, and audit logging. The defect is inherited from upstream proxy-addr (CVE-2026-90711). The vulnerability affects versions 3.0.0 through 5.1.0 and is fixed in 5.1.1.
Affected products
- OpenJS Foundation @fastify/proxy-addr 3.0.0 to 5.1.0
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fixed in version 5.1.1