@42mo/42mo-web-styles (>=0.0.16, <=0.0.30), @aconex/styleguide (>=2.0.1, <=2.2.0) +1691 more potentially affected by CVE-2026-90711 via proxy-addr (>=1.1.2, <=2.0.7)

proxy-addr NPM version =1.1.2, =0.0.16, =2.0.1, =1.1.0, =0.3.1, =6.1.3, =1.0.0, =1.0.0, =0.0.0, =0.7.15, =0.17.5, =0.17.6-rc.1 and more Source cves: CVE-2026-90711 Source advisory: SNYK:JS-PROXYADDR-19812342...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation in its subnet matching logic, where an IPv4-mapped IPv6 trust entry with a short prefix such as ::ffff:10.0.0.0/8 compiles with all-zero leading bits and matches every address rather than the intended block. An attack...

CVE-2026-90711

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

CVE-2026-90711 proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

CVE-2026-90711

proxy-addr is a Node.js module that backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7 , a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix (e.g., ::ffff:10.0.0.0/8 instead of /104) is silently accepted, causing every IPv4 address to be treated as trusted...

CVE-2026-90711 proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

CVE-2026-90711

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

@42mo/42mo-web-styles (>=0.0.16, <=0.0.30), @aconex/styleguide (>=2.0.1, <=2.2.0) +1691 more potentially affected by CVE-2026-90711 via proxy-addr (>=1.1.2, <=2.0.7)

proxy-addr NPM version =1.1.2, =0.0.16, =2.0.1, =1.1.0, =0.3.1, =6.1.3, =1.0.0, =1.0.0, =0.0.0, =0.7.15, =0.17.5, =0.17.6-rc.1 and more Source cves: CVE-2026-90711 Source advisory: MEND:CVE-2026-90711...

CVE-2026-90711 proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

EUVD-2026-78170

On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADIUS proxy client can prevent RADIUS dynami...

EUVD-2026-78166

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling...

PT-2026-92445

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A flaw in the proxy packet processing logic occurs when malformed or truncated input is improperly handled. An unauthenticated remote attacker can trigger an...

PT-2026-92712

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.2.3 through 12.2.15 Description An issue exists in the Proxy User Delegation component of the Oracle User Management product. A low privileged attacker with network access via HTTP can exploit this flaw to...

CVE-2026-83418: Improper Access Control

Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications component: SEPP. Supported versions that are affected are 26.1.200 and 25.2.201. Difficult to exploit vulnerability allows low privileged attacker with network access via...

CVE-2026-83189: Improper Privilege Management

Vulnerability in the Oracle User Management product of Oracle E-Business Suite component: Proxy User Delegation. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle User...

CVE-2026-76685: Integer Overflow or Wraparound

A vulnerability exists in the proxy packet processing logic of the affected component where it improperly processes malformed or truncated input. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input that triggers an integer overflow. Successful...

CVE-2026-83417: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications component: SEPP. Supported versions that are affected are 26.1.200 and 25.2.201. Easily exploitable vulnerability allows unauthenticated attacker with access to the physica...

CVE-2026-11929: Use of a Broken or Risky Cryptographic Algorithm

IBM Security Verify Identity Access Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data...

CVE-2026-11927: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

CVE-2026-91992: Exposure of Sensitive Information to an Unauthorized Actor

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy...