Critical Node.js Flaw Lets Attackers Spoof IPs in Express Apps

Security researchers have disclosed CVE-2026-90711, a critical IP-spoofing vulnerability in the Node.js `proxy-addr` package, rated 9.1 under CVSSv3. The flaw affects versions before 2.0.8 and can undermine applications, including those using Express, that rely on the module to identify client addresses. The package is reportedly downloaded more than 364 million times a month, although the article does not establish how many deployments are vulnerable.

The issue arises when administrators configure a trusted proxy subnet as an IPv4-mapped IPv6 address with a short prefix. According to the linked advisory, the subnet can compile with all-zero leading bits and match every IPv4 address without producing an error. Applications may then trust any client as a proxy and accept a forged `X-Forwarded-For` header, allowing unauthenticated users to inject arbitrary IP addresses into application logic.

Potential consequences include bypassing access controls and rate limits, evading geolocation restrictions and contaminating audit logs. No active exploitation or public proof-of-concept code has been confirmed. Developers should upgrade to `proxy-addr` 2.0.8, which corrects the IPv4-mapped subnet handling. Where an immediate upgrade is not possible, the article recommends specifying IPv4 trust subnets using plain IPv4 notation.