Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for October 2026.

Summary Security vulnerabilities are addressed with IBM Business Automation Insights 26.0.0-IF004 and 24.0.1-IF010. These vulnerabilities have been also addressed in 24.0.0-IF009 and 25.0.0-IF007 Vulnerability Details CVEID:CVE-2026-90711 DESCRIPTION: proxy-addr is a Node.js module that determine...

CVE-2025-57457

OS Command Injection in CURO UC300 IP Phone An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" parameter. PoC: https://github.com/restdone/CVE-2025-57457/blob/main/oscommandinject.mp4 Step...

PT-2026-125481

Name of the Vulnerable Software and Affected Versions libdwarf versions prior to 2.3.4 Description A heap out-of-bounds read occurs in the dwarf debug addr table function when the table starting offset is omitted during the validation of the .debug addr unit length. An attacker can provide a...

PT-2026-123375

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: validate transport header presence in set ipv6 addr When executing IPv6 address rewrite actions on IPv6 fragments, set ipv6 addr calls update ipv6 checksum. If parse ipv6hdr processes a non-first IPv6 fragment, ...

Security Bulletin: Vulnerability in prox-addr Node.js module

Summary Vulnerability in prox-addr Node.js module Vulnerability Details CVEID:CVE-2026-90711 DESCRIPTION: proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust...

PT-2026-135856

Vulnerability summary addressparser ends an angle-addr at the first it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that . "@good.com is the mailbox "[email protected]"@good.com under RFC 5322, and Nodemailer read it as a...

Security Bulletin: Platform Navigator and Automation Assets in IBM Integration are vulnerable to a vulnerability in proxy-addr

Summary Platform Navigator and Automation Assets in IBM Integration are vulnerable to a vulnerability in proxy-addr. CVE-2026-90711 The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-90711 DESCRIPTION: proxy-addr is a Node.js module that determines a request's client addre...

proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

A flaw was found in proxy-addr. When an application defines trusted proxy subnets using IPv4-mapped IPv6 addresses with an improper prefix length, the subnet parser fails open and erroneously treats all incoming network addresses as trusted. A remote, unauthenticated attacker can exploit this...

ROOT-APP-NPM-CVE-2026-90711 CVE-2026-90711 in proxy-addr - Patched by Root

Root has patched CVE-2026-90711 in the proxy-addr package for Root:npm. Multiple fixed versions available...

CVE-2026-92395

A flaw was found in @fastify/proxy-addr. This flaw allows a remote, unauthenticated attacker to bypass access controls and security policies by spoofing client IP Internet Protocol addresses. When configured with certain IPv4-mapped IPv6 network ranges, the plugin improperly treats all incoming...

ROOT-APP-NPM-AIKIDO-2026-101201 AIKIDO-2026-101201 in proxy-addr - Patched by Root

Root has patched AIKIDO-2026-101201 in the proxy-addr package for Root:npm. Multiple fixed versions available...

PT-2026-122657

Root has patched AIKIDO-2026-101201 in the proxy-addr package for Root:npm. Multiple fixed versions available...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Authentication Bypass.

Summary proxy-addr is used by IBM Storage Fusion Data Foundation, which could cause Authentication Bypass. CVE-2026-90711. Vulnerability Details CVEID:CVE-2026-90711 DESCRIPTION: proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs...

PT-2026-110607

A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MAC addr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the...

CVE-2026-90711

A flaw was found in proxy-addr. When an application defines trusted proxy subnets using IPv4-mapped IPv6 addresses with an improper prefix length, the subnet parser fails open and erroneously treats all incoming network addresses as trusted. A remote, unauthenticated attacker can exploit this...

PT-2026-106681

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description A CQ pool leak occurs in the RDMA/rtrs-clt component when a connection is interrupted. The client borrows shared CQ credits in the ADDR RESOLVED handler using the ib cq pool get function...

PT-2026-115735

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted The client borrows shared CQ credits in the ADDR RESOLVED handler via ib cq pool get, before the peer is connected. create cm can return -ERESTARTSYS from wait event...

EUVD-2026-78300

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet...

@42mo/42mo-web-styles (>=0.0.16, <=0.0.30), @aconex/styleguide (>=2.0.1, <=2.2.0) +1691 more potentially affected by CVE-2026-90711 via proxy-addr (>=1.1.2, <=2.0.7)

proxy-addr NPM version =1.1.2, =0.0.16, =2.0.1, =1.1.0, =0.3.1, =6.1.3, =1.0.0, =1.0.0, =0.0.0, =0.7.15, =0.17.5, =0.17.6-rc.1 and more Source cves: CVE-2026-90711 Source advisory: GHSA-JQCG-44MW-7W3H...

NPM: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

NPM: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet vulnerability discovered by ? in WordPress Npm proxy-addr versions = 1.1.0, 2.0.8...