CVE-2026-92395
Description
A flaw was found in @fastify/proxy-addr. This flaw allows a remote, unauthenticated attacker to bypass access controls and security policies by spoofing client IP (Internet Protocol) addresses. When configured with certain IPv4-mapped IPv6 network ranges, the plugin improperly treats all incoming IPv4 connections as trusted reverse proxies. An attacker can exploit this issue by supplying forged proxy request headers, enabling them to circumvent IP-based restrictions, bypass rate limiting, and mislead audit logging.
Statement
Critical severity is assigned because unauthenticated remote attackers can bypass IP-based access controls and rate limiting across affected services without requiring privileges or user interaction. When an application configures proxy trust boundaries using IPv4-mapped IPv6 syntax with shorthand subnet masks, the parser erroneously trusts all external IPv4 addresses. Consequently, any incoming connection can forge forwarding headers to arbitrarily spoof the client origin, undermining network boundaries and security logging in deployed container environments.
Mitigation
To mitigate this vulnerability without code modifications, adjust application configurations that define trusted reverse proxy networks:
1. Configure trusted proxy ranges using standard IPv4 CIDR notation (such as 10.0.0.0/8) rather than IPv4-mapped IPv6 notation.
2. If IPv4-mapped IPv6 notation must be utilized, ensure the prefix length specifies the full 128-bit IPv6 address space (a prefix length between 97 and 128, such as ::ffff:10.0.0.0/104).
Warning: Applying configuration changes requires restarting the affected application service or container, which will cause a temporary service disruption.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.4 | N/A | 9.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
This weakness can allow an attacker to access resources which are not otherwise accessible without proper authentication.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
