[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-90711":6},{"stargazers_count":4,"fetched_at":5},7,"2026-09-15T04:36:07.624Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":684,"aliases":685,"duplicate_of":9,"upstream":686,"downstream":687,"duplicates":688,"related":689,"reserved_at":9,"published_at":690,"modified_at":690,"state":691,"summary":692,"references_raw":699,"kevs":708,"epss":9,"epss_history":709,"metrics":710,"affected":716},"CVE-2026-90711","proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This is a fail-open regression introduced in version 1.1.0. The issue is fixed in proxy-addr 2.0.8, and users should upgrade to 2.0.8 or later. As a workaround, ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.",null,[11,468,527],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-290","Authentication Bypass by Spoofing","This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.","weakness","Incomplete","Base",[19,194,198,202,206,282,286,290,429,433],{"id":20,"name":21,"techniques":22},"CAPEC-21","Exploitation of Trusted Identifiers",[23,140,170],{"id":24,"name":25,"tactics":26,"countermeasures":36},"T1134","Access Token Manipulation",[27,30,33],{"id":28,"name":29},"TA0030","Defense Evasion",{"id":31,"name":32},"TA0005","Stealth",{"id":34,"name":35},"TA0111","Privilege Escalation",[37,42,47,51,55,60,65,69,73,78,82,87,91,95,99,103,107,112,116,120,124,128,132,136],{"id":38,"name":39,"tactic":40},"D3-CTS","Credential Transmission Scoping",{"name":41},"Isolate",{"id":43,"name":44,"tactic":45},"D3-CCSA","Credential Compromise Scope Analysis",{"name":46},"Detect",{"id":48,"name":49,"tactic":50},"D3-OPM","Operational Process Monitoring",{"name":46},{"id":52,"name":53,"tactic":54},"D3-PSA","Process Spawn Analysis",{"name":46},{"id":56,"name":57,"tactic":58},"D3-ST","Session Termination",{"name":59},"Evict",{"id":61,"name":62,"tactic":63},"D3-NTPM","Network Traffic Policy Mapping",{"name":64},"Model",{"id":66,"name":67,"tactic":68},"D3-CR","Credential Revocation",{"name":59},{"id":70,"name":71,"tactic":72},"D3-ANCI","Authentication Cache Invalidation",{"name":59},{"id":74,"name":75,"tactic":76},"D3-DUC","Decoy User Credential",{"name":77},"Deceive",{"id":79,"name":80,"tactic":81},"D3-AM","Access Modeling",{"name":64},{"id":83,"name":84,"tactic":85},"D3-CH","Credential Hardening",{"name":86},"Harden",{"id":88,"name":89,"tactic":90},"D3-MFA","Multi-factor Authentication",{"name":86},{"id":92,"name":93,"tactic":94},"D3-CRO","Credential Rotation",{"name":86},{"id":96,"name":97,"tactic":98},"D3-HBPI","Hardware-based Process Isolation",{"name":41},{"id":100,"name":101,"tactic":102},"D3-TB","Token Binding",{"name":86},{"id":104,"name":105,"tactic":106},"D3-TBA","Token-based Authentication",{"name":86},{"id":108,"name":109,"tactic":110},"D3-RC","Restore Configuration",{"name":111},"Restore",{"id":113,"name":114,"tactic":115},"D3-AEM","Application Exception Monitoring",{"name":46},{"id":117,"name":118,"tactic":119},"D3-RIC","Reissue Credential",{"name":111},{"id":121,"name":122,"tactic":123},"D3-CI","Configuration Inventory",{"name":64},{"id":125,"name":126,"tactic":127},"D3-SCA","System Call Analysis",{"name":46},{"id":129,"name":130,"tactic":131},"D3-SCF","System Call Filtering",{"name":41},{"id":133,"name":134,"tactic":135},"D3-EAL","Executable Allowlisting",{"name":41},{"id":137,"name":138,"tactic":139},"D3-EDL","Executable Denylisting",{"name":41},{"id":141,"name":142,"tactics":143,"countermeasures":147},"T1528","Steal Application Access Token",[144],{"id":145,"name":146},"TA0031","Credential Access",[148,150,152,154,156,158,160,162,164,166,168],{"id":83,"name":84,"tactic":149},{"name":86},{"id":117,"name":118,"tactic":151},{"name":111},{"id":70,"name":71,"tactic":153},{"name":59},{"id":100,"name":101,"tactic":155},{"name":86},{"id":38,"name":39,"tactic":157},{"name":41},{"id":88,"name":89,"tactic":159},{"name":86},{"id":66,"name":67,"tactic":161},{"name":59},{"id":104,"name":105,"tactic":163},{"name":86},{"id":43,"name":44,"tactic":165},{"name":46},{"id":92,"name":93,"tactic":167},{"name":86},{"id":74,"name":75,"tactic":169},{"name":77},{"id":171,"name":172,"tactics":173,"countermeasures":175},"T1539","Steal Web Session Cookie",[174],{"id":145,"name":146},[176,178,180,182,184,186,188,190,192],{"id":38,"name":39,"tactic":177},{"name":41},{"id":74,"name":75,"tactic":179},{"name":77},{"id":83,"name":84,"tactic":181},{"name":86},{"id":88,"name":89,"tactic":183},{"name":86},{"id":70,"name":71,"tactic":185},{"name":59},{"id":43,"name":44,"tactic":187},{"name":46},{"id":92,"name":93,"tactic":189},{"name":86},{"id":66,"name":67,"tactic":191},{"name":59},{"id":117,"name":118,"tactic":193},{"name":111},{"id":195,"name":196,"techniques":197},"CAPEC-22","Exploiting Trust in Client",[],{"id":199,"name":200,"techniques":201},"CAPEC-459","Creating a Rogue Certification Authority Certificate",[],{"id":203,"name":204,"techniques":205},"CAPEC-461","Web Services API Signature Forgery Leveraging Hash Function Extension Weakness",[],{"id":207,"name":208,"techniques":209},"CAPEC-473","Signature Spoof",[210,273],{"id":211,"name":212,"tactics":213,"countermeasures":216},"T1036.001","Invalid Code Signature",[214,215],{"id":28,"name":29},{"id":31,"name":32},[217,221,225,229,233,237,241,245,249,253,257,261,265,269,271],{"id":218,"name":219,"tactic":220},"D3-FA","File Analysis",{"name":46},{"id":222,"name":223,"tactic":224},"D3-FE","File Encryption",{"name":86},{"id":226,"name":227,"tactic":228},"D3-FIM","File Integrity Monitoring",{"name":46},{"id":230,"name":231,"tactic":232},"D3-DA","Dynamic Analysis",{"name":46},{"id":234,"name":235,"tactic":236},"D3-EFA","Emulated File Analysis",{"name":46},{"id":238,"name":239,"tactic":240},"D3-DF","Decoy File",{"name":77},{"id":242,"name":243,"tactic":244},"D3-FEV","File Eviction",{"name":59},{"id":246,"name":247,"tactic":248},"D3-RF","Restore File",{"name":111},{"id":250,"name":251,"tactic":252},"D3-CF","Content Filtering",{"name":41},{"id":254,"name":255,"tactic":256},"D3-LFP","Local File Permissions",{"name":41},{"id":258,"name":259,"tactic":260},"D3-RFAM","Remote File Access Mediation",{"name":41},{"id":262,"name":263,"tactic":264},"D3-CQ","Content Quarantine",{"name":41},{"id":266,"name":267,"tactic":268},"D3-CM","Content Modification",{"name":41},{"id":133,"name":134,"tactic":270},{"name":41},{"id":137,"name":138,"tactic":272},{"name":41},{"id":274,"name":275,"tactics":276,"countermeasures":281},"T1553.002","Code Signing",[277,278],{"id":28,"name":29},{"id":279,"name":280},"TA0112","Defense Impairment",[],{"id":283,"name":284,"techniques":285},"CAPEC-476","Signature Spoofing by Misrepresentation",[],{"id":287,"name":288,"techniques":289},"CAPEC-59","Session Credential Falsification through Prediction",[],{"id":291,"name":292,"techniques":293},"CAPEC-60","Reusing Session IDs (aka Session Replay)",[294,324],{"id":295,"name":296,"tactics":297,"countermeasures":301},"T1134.001","Token Impersonation/Theft",[298,299,300],{"id":28,"name":29},{"id":31,"name":32},{"id":34,"name":35},[302,304,306,308,310,312,314,316,318,320,322],{"id":66,"name":67,"tactic":303},{"name":59},{"id":43,"name":44,"tactic":305},{"name":46},{"id":38,"name":39,"tactic":307},{"name":41},{"id":70,"name":71,"tactic":309},{"name":59},{"id":100,"name":101,"tactic":311},{"name":86},{"id":104,"name":105,"tactic":313},{"name":86},{"id":74,"name":75,"tactic":315},{"name":77},{"id":83,"name":84,"tactic":317},{"name":86},{"id":92,"name":93,"tactic":319},{"name":86},{"id":88,"name":89,"tactic":321},{"name":86},{"id":117,"name":118,"tactic":323},{"name":111},{"id":325,"name":326,"tactics":327,"countermeasures":332},"T1550.004","Web Session Cookie",[328,329],{"id":28,"name":29},{"id":330,"name":331},"TA0109","Lateral Movement",[333,335,337,339,341,345,349,353,357,359,361,365,369,373,377,379,383,385,389,391,395,399,401,403,407,411,415,417,421,425],{"id":92,"name":93,"tactic":334},{"name":86},{"id":129,"name":130,"tactic":336},{"name":41},{"id":117,"name":118,"tactic":338},{"name":111},{"id":38,"name":39,"tactic":340},{"name":41},{"id":342,"name":343,"tactic":344},"D3-PHDURA","Per Host Download-Upload Ratio Analysis",{"name":46},{"id":346,"name":347,"tactic":348},"D3-APCA","Application Protocol Command Analysis",{"name":46},{"id":350,"name":351,"tactic":352},"D3-PSMD","Process Self-Modification Detection",{"name":46},{"id":354,"name":355,"tactic":356},"D3-RTSD","Remote Terminal Session Detection",{"name":46},{"id":52,"name":53,"tactic":358},{"name":46},{"id":96,"name":97,"tactic":360},{"name":41},{"id":362,"name":363,"tactic":364},"D3-KBPI","Kernel-based Process Isolation",{"name":41},{"id":366,"name":367,"tactic":368},"D3-ABPI","Application-based Process Isolation",{"name":41},{"id":370,"name":371,"tactic":372},"D3-HS","Host Shutdown",{"name":59},{"id":374,"name":375,"tactic":376},"D3-PMAD","Protocol Metadata Anomaly Detection",{"name":46},{"id":66,"name":67,"tactic":378},{"name":59},{"id":380,"name":381,"tactic":382},"D3-HR","Host Reboot",{"name":59},{"id":43,"name":44,"tactic":384},{"name":46},{"id":386,"name":387,"tactic":388},"D3-NTF","Network Traffic Filtering",{"name":41},{"id":74,"name":75,"tactic":390},{"name":77},{"id":392,"name":393,"tactic":394},"D3-CSPP","Client-server Payload Profiling",{"name":46},{"id":396,"name":397,"tactic":398},"D3-PT","Process Termination",{"name":59},{"id":83,"name":84,"tactic":400},{"name":86},{"id":88,"name":89,"tactic":402},{"name":86},{"id":404,"name":405,"tactic":406},"D3-PLA","Process Lineage Analysis",{"name":46},{"id":408,"name":409,"tactic":410},"D3-NTCD","Network Traffic Community Deviation",{"name":46},{"id":412,"name":413,"tactic":414},"D3-PS","Process Suspension",{"name":59},{"id":70,"name":71,"tactic":416},{"name":59},{"id":418,"name":419,"tactic":420},"D3-NTSA","Network Traffic Signature Analysis",{"name":46},{"id":422,"name":423,"tactic":424},"D3-WSAM","Web Session Access Mediation",{"name":41},{"id":426,"name":427,"tactic":428},"D3-UGLPA","User Geolocation Logon Pattern Analysis",{"name":46},{"id":430,"name":431,"techniques":432},"CAPEC-667","Bluetooth Impersonation AttackS (BIAS)",[],{"id":434,"name":435,"techniques":436},"CAPEC-94","Adversary in the Middle (AiTM)",[437],{"id":438,"name":439,"tactics":440,"countermeasures":445},"T1557","Adversary-in-the-Middle",[441,442],{"id":145,"name":146},{"id":443,"name":444},"TA0100","Collection",[446,448,450,452,454,456,458,462,464,466],{"id":346,"name":347,"tactic":447},{"name":46},{"id":392,"name":393,"tactic":449},{"name":46},{"id":342,"name":343,"tactic":451},{"name":46},{"id":418,"name":419,"tactic":453},{"name":46},{"id":408,"name":409,"tactic":455},{"name":46},{"id":354,"name":355,"tactic":457},{"name":46},{"id":459,"name":460,"tactic":461},"D3-CAA","Connection Attempt Analysis",{"name":46},{"id":426,"name":427,"tactic":463},{"name":46},{"id":374,"name":375,"tactic":465},{"name":46},{"id":386,"name":387,"tactic":467},{"name":41},{"_key":469,"id":469,"name":470,"description":471,"type":15,"status":472,"abstraction":17,"likelihood_of_exploit":9,"capec":473},"CWE-348","Use of Less Trusted Source","The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.","Draft",[474,503,515,519,523],{"id":475,"name":476,"techniques":477},"CAPEC-141","Cache Poisoning",[478],{"id":479,"name":480,"tactics":481,"countermeasures":484},"T1557.002","ARP Cache Poisoning",[482,483],{"id":145,"name":146},{"id":443,"name":444},[485,487,489,491,493,495,497,499,501],{"id":386,"name":387,"tactic":486},{"name":41},{"id":408,"name":409,"tactic":488},{"name":46},{"id":354,"name":355,"tactic":490},{"name":46},{"id":426,"name":427,"tactic":492},{"name":46},{"id":374,"name":375,"tactic":494},{"name":46},{"id":392,"name":393,"tactic":496},{"name":46},{"id":342,"name":343,"tactic":498},{"name":46},{"id":418,"name":419,"tactic":500},{"name":46},{"id":346,"name":347,"tactic":502},{"name":46},{"id":504,"name":505,"techniques":506},"CAPEC-142","DNS Cache Poisoning",[507],{"id":508,"name":509,"tactics":510,"countermeasures":514},"T1584.002","DNS Server",[511],{"id":512,"name":513},"TA0042","Resource Development",[],{"id":516,"name":517,"techniques":518},"CAPEC-73","User-Controlled Filename",[],{"id":520,"name":521,"techniques":522},"CAPEC-76","Manipulating Web Input to File System Calls",[],{"id":524,"name":525,"techniques":526},"CAPEC-85","AJAX Footprinting",[],{"_key":528,"id":528,"name":529,"description":530,"type":15,"status":16,"abstraction":531,"likelihood_of_exploit":9,"capec":532},"CWE-697","Incorrect Comparison","The product compares two entities in a security-relevant context, but the comparison is incorrect.","Pillar",[533,537,541,545,549,553,557,598,602,606,610,614,618,622,626,630,634,638,642,646,650,654,656,660,664,668,672,676,680],{"id":534,"name":535,"techniques":536},"CAPEC-10","Buffer Overflow via Environment Variables",[],{"id":538,"name":539,"techniques":540},"CAPEC-120","Double Encoding",[],{"id":542,"name":543,"techniques":544},"CAPEC-14","Client-side Injection-induced Buffer Overflow",[],{"id":546,"name":547,"techniques":548},"CAPEC-15","Command Delimiters",[],{"id":550,"name":551,"techniques":552},"CAPEC-182","Flash Injection",[],{"id":554,"name":555,"techniques":556},"CAPEC-24","Filter Failure through Buffer Overflow",[],{"id":558,"name":559,"techniques":560},"CAPEC-267","Leverage Alternate Encoding",[561],{"id":562,"name":563,"tactics":564,"countermeasures":567},"T1027","Obfuscated Files or Information",[565,566],{"id":28,"name":29},{"id":31,"name":32},[568,570,572,574,576,578,580,582,584,586,588,590,592,594,596],{"id":226,"name":227,"tactic":569},{"name":46},{"id":238,"name":239,"tactic":571},{"name":77},{"id":133,"name":134,"tactic":573},{"name":41},{"id":137,"name":138,"tactic":575},{"name":41},{"id":254,"name":255,"tactic":577},{"name":41},{"id":246,"name":247,"tactic":579},{"name":111},{"id":242,"name":243,"tactic":581},{"name":59},{"id":230,"name":231,"tactic":583},{"name":46},{"id":258,"name":259,"tactic":585},{"name":41},{"id":222,"name":223,"tactic":587},{"name":86},{"id":218,"name":219,"tactic":589},{"name":46},{"id":266,"name":267,"tactic":591},{"name":41},{"id":250,"name":251,"tactic":593},{"name":41},{"id":262,"name":263,"tactic":595},{"name":41},{"id":234,"name":235,"tactic":597},{"name":46},{"id":599,"name":600,"techniques":601},"CAPEC-3","Using Leading 'Ghost' Character Sequences to Bypass Input Filters",[],{"id":603,"name":604,"techniques":605},"CAPEC-41","Using Meta-characters in E-mail Headers to Inject Malicious Payloads",[],{"id":607,"name":608,"techniques":609},"CAPEC-43","Exploiting Multiple Input Interpretation Layers",[],{"id":611,"name":612,"techniques":613},"CAPEC-44","Overflow Binary Resource File",[],{"id":615,"name":616,"techniques":617},"CAPEC-45","Buffer Overflow via Symbolic Links",[],{"id":619,"name":620,"techniques":621},"CAPEC-46","Overflow Variables and Tags",[],{"id":623,"name":624,"techniques":625},"CAPEC-47","Buffer Overflow via Parameter Expansion",[],{"id":627,"name":628,"techniques":629},"CAPEC-52","Embedding NULL Bytes",[],{"id":631,"name":632,"techniques":633},"CAPEC-53","Postfix, Null Terminate, and Backslash",[],{"id":635,"name":636,"techniques":637},"CAPEC-6","Argument Injection",[],{"id":639,"name":640,"techniques":641},"CAPEC-64","Using Slashes and URL Encoding Combined to Bypass Validation Logic",[],{"id":643,"name":644,"techniques":645},"CAPEC-67","String Format Overflow in syslog()",[],{"id":647,"name":648,"techniques":649},"CAPEC-7","Blind SQL Injection",[],{"id":651,"name":652,"techniques":653},"CAPEC-71","Using Unicode Encoding to Bypass Validation Logic",[],{"id":516,"name":517,"techniques":655},[],{"id":657,"name":658,"techniques":659},"CAPEC-78","Using Escaped Slashes in Alternate Encoding",[],{"id":661,"name":662,"techniques":663},"CAPEC-79","Using Slashes in Alternate Encoding",[],{"id":665,"name":666,"techniques":667},"CAPEC-8","Buffer Overflow in an API Call",[],{"id":669,"name":670,"techniques":671},"CAPEC-80","Using UTF-8 Encoding to Bypass Validation Logic",[],{"id":673,"name":674,"techniques":675},"CAPEC-88","OS Command Injection",[],{"id":677,"name":678,"techniques":679},"CAPEC-9","Buffer Overflow in Local Command-Line Utilities",[],{"id":681,"name":682,"techniques":683},"CAPEC-92","Forced Integer Overflow",[],[],[],[],[],[],[],"2026-09-15T06:19:46.332Z","PUBLISHED",{"cisa_kev":693,"cisa_ransomware":693,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":694,"severity_score":695,"severity_version":696,"severity_source":697,"severity_vector":698,"severity_status":691},false,"critical",9.1,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",[700,704],{"url":701,"sources":702,"tags":703},"https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h",[697],[],{"url":705,"sources":706,"tags":707},"https://cna.openjsf.org/security-advisories.html",[697],[],[],[],[711],{"source":697,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":712,"cvss_v4_0":9},{"baseScore":695,"baseSeverity":713,"vectorString":698,"impactScore":714,"exploitabilityScore":715},"CRITICAL",8.7,10,[717],{"ecosystem":9,"name":718,"vendor":718,"product":718,"cpe_part":719,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":720},"proxy-addr","a",[721],{"version":722,"is_range":723,"range_type":697,"version_start":724,"version_start_type":725,"version_end":726,"version_end_type":727,"fixed_in":9},">= 1.1.0, \u003C 2.0.8",true,"1.1.0","including","2.0.8","excluding"]