Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

Bump transitive proxy-addr to 2.0.8 (CVE-2026-90711)

Offen Anfängerfreundlich
  • Stimmt etwas nicht?
#780 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
2/5
Geschätzter Aufwand
1-3 Stunden
Anfängerfreundlichkeit
72/100
Issue-Typ
Bug
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
express, nodejs, typescript
Bereich
backend, security

Rechercherichtung

Beginne in package.json, wo der bestehende pnpm-overrides-Block bereits serialize-javascript fixiert; füge dort einen Eintrag für proxy-addr hinzu und führe dann pnpm install aus, um pnpm-lock.yaml zu aktualisieren. Prüfe die Request-IP-Leser in src/controllers/admin/post-settings-restore-controller.ts:21 und patch-settings-controller.ts:73 nur zum Kontext, da die Korrektur sie nicht ändert. Fertig ist, wenn pnpm why proxy-addr 2.0.8 auflöst und ein frozen install erfolgreich durchläuft.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Summary

[email protected] resolves into this tree via [email protected] — see pnpm-lock.yaml, [email protected] at the dependency edge under express. That version is affected by CVE-2026-90711 (GHSA-jqcg-44mw-7w3h, Aikido AIKIDO-2026-101201, scored critical), fixed in 2.0.8.

The defect

proxy-addr accepts an IPv4-mapped IPv6 trust subnet with an IPv4-sized prefix — ::ffff:10.0.0.0/8 instead of ::ffff:10.0.0.0/104 — and treats that as trusting every IPv4 address. The socket peer is then counted as hop 0, so any unauthenticated client can set X-Forwarded-For to an arbitrary address. Everything built on the resolved client IP — IP allow-lists, rate limiting, geolocation, audit logging — becomes spoofable.

Exposure here: low, but not zero
  • createWebApp() in src/factories/web-app-factory.ts calls express() and never sets trust proxy, so Express keeps its default of false and req.ip is the socket peer. The relay's own client-IP logic does not go through Express at all: it uses getRemoteAddress() / isTrustedProxy() in src/utils/http.ts, which trust a forwarded header only against configured proxies — the hardening from #493.
  • But request.ip is read directly in src/controllers/admin/post-settings-restore-controller.ts:21 and src/controllers/admin/patch-settings-controller.ts:73. In any deployment that sets trust proxy to a proxy subnet — the common pattern behind Cloudflare or nginx, and frequently written in IPv4-mapped IPv6 notation — proxy-addr becomes load-bearing for those paths, and that is precisely the configuration this CVE turns into an authentication bypass.
Fix

[email protected] declares ~2.0.7 and [email protected] declares ^2.0.7; both already accept 2.0.8, so no framework change is needed. This repo already carries a pnpm overrides block (serialize-javascript), so it is one line:

"pnpm": { "overrides": { "proxy-addr": "^2.0.8" } }

then pnpm install to refresh the lockfile and pnpm why proxy-addr to confirm 2.0.8 resolves.

Not urgent for a default deployment, but it is a zero-risk bump that closes the class outright, and cheaper now than reasoning about each operator's proxy configuration later.

Advisory: https://intel.aikido.dev/cve/AIKIDO-2026-101201 · Upstream: https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h

One pnpm note, from doing this on cameri/akkadian-agent minutes after filing. At the [email protected] this repo pins, the package.json pnpm.overrides field above works — the existing serialize-javascript override proves it (declared >=7.0.3 <8, resolved 7.0.5 in the lockfile). But pnpm 11 no longer reads that field at all; it warns The "pnpm" field in package.json is no longer read by pnpm ... "pnpm.overrides" and ignores the setting. My first attempt there failed that way, and what caught it was pnpm install refusing with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH — a frozen install compares the override config against the lockfile, so a silently-ignored override cannot reach a commit. When this repo moves to pnpm 11, the overrides block has to move to pnpm-workspace.yaml (akkadian-agent got one that way, entry written in the same pkg@range: '>=version' style as its existing list).

Vorherrschende Sprache
TypeScript
Sterne
829
Forks
234
Ø Merge
2 T. 10 Std.
Gemergte PRs (30 T.)
24

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus cameri/nostream

Alle Issues in cameri/nostream

Ähnliche Issues

Weitere Issues zu TypeScript

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.