CVE-2026-90711
Description
A flaw was found in proxy-addr. When an application defines trusted proxy subnets using IPv4-mapped IPv6 addresses with an improper prefix length, the subnet parser fails open and erroneously treats all incoming network addresses as trusted. A remote, unauthenticated attacker can exploit this vulnerability by submitting a forged X-Forwarded-For header to spoof their client IP address. This flaw allows attackers to bypass IP-based access controls, rate limiting, and audit logging.
Statement
This vulnerability is rated as Important because unauthenticated remote attackers can spoof client IP addresses and circumvent security controls, such as rate limits or network access lists, by sending custom forwarding headers. Exploitation is contingent on application configurations that define reverse proxy trust subnets using IPv4-mapped IPv6 notation with short IPv4 prefix lengths. Environments configuring trusted proxies via canonical IPv4 CIDR blocks, hostnames, or default loopback addresses are not vulnerable to this behavior.
Mitigation
To mitigate this flaw through configuration:
1. Configure trusted proxy definitions using standard IPv4 notation (such as `10.0.0.0/8`) rather than IPv4-mapped IPv6 notation.
2. If IPv4-mapped IPv6 notation is required, set the subnet prefix length to at least 97 to cover the mapped boundary (for example, specify `::ffff:10.0.0.0/104` instead of `::ffff:10.0.0.0/8`).
3. Alternatively, sanitize or strip incoming `X-Forwarded-For` headers at edge load balancers or boundary reverse proxies before passing traffic to backend applications.
Warning: Modifying application configuration files requires restarting the Node.js application service, which will temporarily interrupt service availability and active connections.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 9.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
This weakness can allow an attacker to access resources which are not otherwise accessible without proper authentication.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
