Vulnerability in @fastify/proxy-addr Plugin for Fastify Framework

CVE-2026-92395

What is CVE-2026-92395?

The @fastify/proxy-addr plugin facilitates the identification of a client's address in Fastify applications behind trusted reverse proxies. Versions 3.0.0 to 5.1.0 contain a security flaw where an improperly configured IPv4-mapped IPv6 trust subnet can mislead the plugin, trusting every IPv4 address globally instead of the designated range. As a direct consequence, an unauthenticated client could exploit this to manipulate X-Forwarded-For headers, evading IP-based access controls and undermining rate limiting and audit logging measures. Users are strongly advised to upgrade to version 5.1.1 or later, or alternatively, configure trust subnets using a prefix length of at least 97.

References