proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This is a fail-open regression introduced in version 1.1.0. The issue is fixed in proxy-addr 2.0.8, and users should upgrade to 2.0.8 or later. As a workaround, ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-90711 is a critical vulnerability in the proxy-addr Node.js module that affects how Express.js and other frameworks determine client IP addresses behind reverse proxies. When administrators configure IPv4-mapped IPv6 trust subnets with incorrect prefix lengths (e.g., ::ffff:10.0.0.0/8 instead of ::ffff:10.0.0.0/104), the module fails to validate the notation and instead trusts the entire IPv4 address space. This means any attacker from any IPv4 address on the internet can forge their origin to appear as a trusted client at hop 0, completely bypassing authentication and authorization controls that rely on IP-based trust. Organizations running proxy-addr versions 1.1.0 through 2.0.7 are immediately affected, particularly those using Express.js in production environments where reverse proxies handle routing and the application depends on accurate client IP detection for security decisions.
While Casky.ai currently has no mapped skills directly addressing this CVE, practitioners using Claude AI with extended reasoning can detect attack patterns associated with this vulnerability by analyzing authentication bypass attempts and suspicious request patterns. Security teams should focus on detecting anomalies in request origin chains: requests claiming trusted IP status from unexpected geographic locations, privilege escalation attempts following requests with spoofed trusted IPs, and authorization decisions that contradict user behavior patterns. By examining proxy header manipulation (X-Forwarded-For, CF-Connecting-IP, X-Real-IP) against actual connection metadata and monitoring for inconsistencies between claimed and verified client addresses, organizations can identify exploitation attempts. As this vulnerability gains prominence, Casky will develop targeted skills mapping to techniques like T1021 (Remote Service Session Hijacking) and T1550 (Use Alternate Authentication Material) to help practitioners systematize detection of these trust boundary violations.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-90711. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation