proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthen

A security vulnerability exists in the Node.js proxy-addr module (versions 1.1.0 through 2.0.7) that backs Express req.ip and req.ips. When a trust subnet is written in IPv4-mapped IPv6 notation with an IPv4-sized prefix (e.g., ::ffff:10.0.0.0/8 instead of ::ffff:10.0.0.0/104), the module silently accepts it but incorrectly trusts every IPv4 address on the internet. This fail-open regression allows any unauthenticated client to supply an arbitrary X-Forwarded-For header and spoof their apparent IP address. The impact includes bypassing IP-based access control, rate limiting, geolocation, and audit logging. The vulnerability was introduced in version 1.1.0 and is fixed in proxy-addr 2.0.8. Users should upgrade immediately. As a workaround, ensure IPv4-mapped IPv6 trust subnets use a prefix length of at least 97, or use plain IPv4 notation instead.