Fastify Proxy-Addr Fastify Proxy-Addr vulnerabilities

CVE-2026-90711 [CRITICAL] CWE-290 CVE-2026-90711: proxy-addr is a Node.js module that determines a request's client address behind trusted reverse pro proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without