CVE-2026-90711

{
  "etk_id": "ETK-2026-225",
  "cve_id": "CVE-2026-90711",
  "display_id": "CVE-2026-90711",
  "ghsa_id": "GHSA-jqcg-44mw-7w3h",
  "euvd_id": "EUVD-2026-78300",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Proxy trust-range validation flaw in proxy-addr",
  "summary": "proxy-addr before 2.0.8 can incorrectly treat arbitrary IPv4 clients as trusted proxies when an application uses certain IPv4-mapped IPv6 or zero-leading IPv6 trust ranges. An unauthenticated client may then influence the client address derived from forwarding headers, undermining controls that rely on source IP addresses. Exploitation depends on the application having an affected proxy-trust configuration.",
  "mitigation": "Upgrade proxy-addr to version 2.0.8 or later. Until upgraded, express IPv4 trusted ranges in IPv4 notation or correct IPv4-mapped IPv6 prefixes so they include the mapped-address marker.",
  "vendor": "npm",
  "product": "npm:proxy-addr",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.1.0, < 2.0.8"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "2.0.8"
      ],
      "package_name": "proxy-addr",
      "purl": "pkg:npm/proxy-addr"
    }
  ],
  "cwes": [
    290
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": 0.0033,
  "epss_percentile": 0.2496,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 5.33564445,
  "t0_at": "2026-09-15T06:19:46.332000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-01T09:57:34.385191+00:00",
      "days": 16.151250615636574,
      "is_lower_bound": false,
      "measured_at": "2026-09-15T06:19:46.332000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-09-15T06:19:46.332000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-15T06:19:46.332000+00:00",
      "url": "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h"
    }
  }
}