Bug 2533602 (CVE-2026-90711)

Summary: CVE-2026-90711 proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aazores, abarbaro, abrianik, abuckta, akostadi, alizardo, amasferr, anpicker, anthomas, ataylor, bbrownin, blitton, bparees, brasmith, cdrage, cmah, cochase, csuconic, dbosanac, dbruscin, dhanak, dkuc, dmayorov, doconnor, dranck, drosa, dschmidt, dsimansk, dymurray, eaguilar, ebaron, eborisov, eglynn, ehelms, ehugonne, fmariani, ggainey, ggrzybek, gmalinko, gtully, hasun, ibolton, ikhan, janstey, jchui, jfula, jhe, jjoyce, jlanda, jlledo, jmatsuok, jmatthew, jmontleo, jowilson, jpasqual, jpretori, jraez, jreimann, jschluet, jsherman, jtolenti, juwatts, jwong, jwon, kaycoth, kingland, kshier, ktsao, kvanderr, lball, lchilton, lhh, mbarnett, mburns, mcarlett, mdellweg, mdessi, mgarciac, mhulan, mnovotny, mrizzi, mstipich, nboldt, ngough, nmoumoul, nyancey, oaljalju, omaciel, ometelka, orabin, osousa, pantinor, parichar, pcattana, pcreech, pdelbell, pgaikwad, pjindal, psrna, ptisnovs, rbobbitt, rchan, rexwhite, rgemmell, rgodfrey, rhel-process-autobot, rjohnson, rstepani, rushinde, sausingh, sdawley, sfeifer, simaishi, slucidi, smallamp, sseago, stcannon, sthirugn, syedriko, tasato, tbish, tcunning, tlavocat, tmalecek, tsedmik, ttakamiy, veshanka, watson-tool-maintainers, xdharmai, yfang, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in proxy-addr. When an application defines trusted proxy subnets using IPv4-mapped IPv6 addresses with an improper prefix length, the subnet parser fails open and erroneously treats all incoming network addresses as trusted. A remote, unauthenticated attacker can exploit this vulnerability by submitting a forged X-Forwarded-For header to spoof their client IP address. This flaw allows attackers to bypass IP-based access controls, rate limiting, and audit logging.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2547483, 2547484, 2547485, 2547486, 2547487, 2547489, 2547490, 2547491, 2547493, 2547496, 2547497, 2547488, 2547492    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-15 06:41:49 UTC 
proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This is a fail-open regression introduced in version 1.1.0. The issue is fixed in proxy-addr 2.0.8, and users should upgrade to 2.0.8 or later. As a workaround, ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.