# CVE-2026-92395: @fastify/proxy-addr IP spoofing via IPv4-mapped IPv6 trust subnet

Source: https://junglewise.ai/threats/cve-2026-92395-fastify-proxy-addr-ip-spoofing-via-ipv4-mapped-ipv6-trust-subnet  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92395 · Severity: critical · CVSS 9.1 · Published 2026-09-16

@fastify/proxy-addr is a Fastify plugin that determines a user's real IP address when applications sit behind reverse proxies, enabling IP-based access controls and logging. When misconfigured with certain IPv6 address formats, the plugin incorrectly trusts all IPv4 clients, allowing attackers to forge their source IP and bypass security controls like rate limiting, geolocation restrictions, and audit trails.

Vendors: [OpenJS Foundation](https://junglewise.ai/threats/vendors/openjs-foundation).

## Quick answers

**Is CVE-2026-92395 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92395 being exploited in the wild.

**How severe is CVE-2026-92395?** Critical severity, with a CVSS score of 9.1, published 16 September 2026.

**Which products and versions are affected?** OpenJS Foundation @Fastify/Proxy-Addr 3.0.0 to 5.1.0.

**Is there a fix for CVE-2026-92395?** A patch was published on 2026-09-16: Fixed in version 5.1.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92395 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-92395?** Check whether you run OpenJS Foundation @Fastify/Proxy-Addr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an incorrect comparison/parsing issue (CWE-697, CWE-348) in how IPv4-mapped IPv6 CIDR blocks are validated. When a trust subnet is written as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, the subnet compiles to match all IPv4 addresses rather than the intended /8 block. Similarly, zero-leading-bit IPv6 subnets like ::/1 are incorrectly trusted. An unauthenticated remote attacker can then supply an arbitrary X-Forwarded-For header, and the plugin will return that spoofed address as the client IP (via proxyaddr(req, trust), request.ip, or request.ips). This defeats IP-based access control, rate limiting, geolocation, and audit logging. The defect is inherited from upstream proxy-addr (CVE-2026-90711). The vulnerability affects versions 3.0.0 through 5.1.0 and is fixed in 5.1.1.

## Affected products

- OpenJS Foundation @fastify/proxy-addr 3.0.0 to 5.1.0

## Timeline

- 2026-09-16: disclosed
- 2026-09-16: patched: Fixed in version 5.1.1

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/fastify/proxy-addr/security/advisories/GHSA-8cmm-mhw6-v7xq](https://github.com/fastify/proxy-addr/security/advisories/GHSA-8cmm-mhw6-v7xq)