Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

Bump transitive proxy-addr to 2.0.8 (CVE-2026-90711)

Aberta Para iniciantes
  • Algo errado?
#780 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
2/5
Tempo estimado
1-3 horas
Facilidade para iniciantes
72/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
express, nodejs, typescript
Domínio
backend, security

Direção de pesquisa

Comece em package.json, onde o bloco de overrides do pnpm já fixa serialize-javascript; adicione ali uma entrada para proxy-addr e depois execute pnpm install para atualizar o pnpm-lock.yaml. Verifique os leitores de IP da requisição em src/controllers/admin/post-settings-restore-controller.ts:21 e patch-settings-controller.ts:73 apenas como contexto, pois a correção não altera esses trechos. Está concluído quando pnpm why proxy-addr resolve para 2.0.8 e uma instalação frozen passa.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Summary

[email protected] resolves into this tree via [email protected] — see pnpm-lock.yaml, [email protected] at the dependency edge under express. That version is affected by CVE-2026-90711 (GHSA-jqcg-44mw-7w3h, Aikido AIKIDO-2026-101201, scored critical), fixed in 2.0.8.

The defect

proxy-addr accepts an IPv4-mapped IPv6 trust subnet with an IPv4-sized prefix — ::ffff:10.0.0.0/8 instead of ::ffff:10.0.0.0/104 — and treats that as trusting every IPv4 address. The socket peer is then counted as hop 0, so any unauthenticated client can set X-Forwarded-For to an arbitrary address. Everything built on the resolved client IP — IP allow-lists, rate limiting, geolocation, audit logging — becomes spoofable.

Exposure here: low, but not zero
  • createWebApp() in src/factories/web-app-factory.ts calls express() and never sets trust proxy, so Express keeps its default of false and req.ip is the socket peer. The relay's own client-IP logic does not go through Express at all: it uses getRemoteAddress() / isTrustedProxy() in src/utils/http.ts, which trust a forwarded header only against configured proxies — the hardening from #493.
  • But request.ip is read directly in src/controllers/admin/post-settings-restore-controller.ts:21 and src/controllers/admin/patch-settings-controller.ts:73. In any deployment that sets trust proxy to a proxy subnet — the common pattern behind Cloudflare or nginx, and frequently written in IPv4-mapped IPv6 notation — proxy-addr becomes load-bearing for those paths, and that is precisely the configuration this CVE turns into an authentication bypass.
Fix

[email protected] declares ~2.0.7 and [email protected] declares ^2.0.7; both already accept 2.0.8, so no framework change is needed. This repo already carries a pnpm overrides block (serialize-javascript), so it is one line:

"pnpm": { "overrides": { "proxy-addr": "^2.0.8" } }

then pnpm install to refresh the lockfile and pnpm why proxy-addr to confirm 2.0.8 resolves.

Not urgent for a default deployment, but it is a zero-risk bump that closes the class outright, and cheaper now than reasoning about each operator's proxy configuration later.

Advisory: https://intel.aikido.dev/cve/AIKIDO-2026-101201 · Upstream: https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h

One pnpm note, from doing this on cameri/akkadian-agent minutes after filing. At the [email protected] this repo pins, the package.json pnpm.overrides field above works — the existing serialize-javascript override proves it (declared >=7.0.3 <8, resolved 7.0.5 in the lockfile). But pnpm 11 no longer reads that field at all; it warns The "pnpm" field in package.json is no longer read by pnpm ... "pnpm.overrides" and ignores the setting. My first attempt there failed that way, and what caught it was pnpm install refusing with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH — a frozen install compares the override config against the lockfile, so a silently-ignored override cannot reach a commit. When this repo moves to pnpm 11, the overrides block has to move to pnpm-workspace.yaml (akkadian-agent got one that way, entry written in the same pkg@range: '>=version' style as its existing list).

Linguagem predominante
TypeScript
Estrelas
829
Forks
234
Merge médio
2d 10h
PRs com merge (30d)
24

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de cameri/nostream

Todas as issues de cameri/nostream

Issues semelhantes

Mais issues de TypeScript

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.