## What Happened
A severe IP spoofing flaw in the Node.js proxy-addr module (CVE-2026-90711, CVSS 9.1) can allow unauthenticated users to bypass network access controls by spoofing client IP addresses.
## Technical Details
- The issue is triggered by a misconfiguration pattern involving “trust subnets” set as an IPv4-mapped IPv6 address with a short prefix.
- Due to the way the subnet is compiled, the resulting rule can match all IPv4 addresses instead of only the intended block.
- When the application trusts the client as a valid proxy, it extracts the client IP from the unverified X-Forwarded-For HTTP header.
- This enables attackers to inject arbitrary IP values into application logic.
- The advisory states there is no confirmed in-the-wild exploitation and no public proof-of-concept.
## Affected
- proxy-addr versions prior to 2.0.8 (affected: 1.1.0 mentioned in the article)
## Impact
- Access control list bypasses
- Rate limiting bypass
- Geolocation restriction bypass
- Corruption of security audit logs (via spoofed client IPs)
## Mitigation
1. Upgrade proxy-addr to 2.0.8 (patched in 2.0.8).
2. If upgrading is temporarily impossible, configure IPv4 trust subnets using strict plain IPv4 notation (avoid IPv4-mapped IPv6 trust subnets with short prefixes).