Detections
Analytics
Echo: proxy-addr: security update to 2.0.8
critical Tenable Cloud Security Plugin ID 473537
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies,
and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in
IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct
::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than
the block it names. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can
supply an arbitrary X-Forwarded-For header and control the address the application reads, which defeats
IP-based access control, rate limiting, geolocation, and audit logging. This is a fail-open regression
introduced in version 1.1.0. The issue is fixed in proxy-addr 2.0.8, and users should upgrade to 2.0.8 or
later. As a workaround, ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or
express the range in plain IPv4 notation. (CVE-2026-90711)
Solution
Update the proxy-addr library and its related packages to version 2.0.8 or later.See Also
Plugin Details
Severity: Critical
ID: 473537
Version: Revision 1.1
Type: Local
Family: Echo Local Security Checks
Published: 10/7/2026
Updated: 10/7/2026
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.48
CVSS v2
Risk Factor: High
Base Score: 9.4
Temporal Score: 7
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N
CVSS Score Source: CVE-2026-90711
CVSS v3
Risk Factor: Critical
Base Score: 9.1
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 10/7/2026
Vulnerability Publication Date: 9/15/2026
Reference Information
CVE: CVE-2026-90711