Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

Fix availableCritical · CVSS 9.1EPSS 0.26%

Published Oct 5, 2026 · updated Oct 5, 2026

What to do

  1. Upgrade to a fixed version: proxy-addr 2.0.8.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npmproxy-addr

Vulnerable versions
>= 1.1.0, < 2.0.8
Fixed in
2.0.8

Check your project: npm ls proxy-addr --all

Is proxy-addr@2.0.8 safe to install? See the upgrade verdict →

Sources

CWE-290 Authentication Bypass by Spoofing · CWE-348 Use of Less Trusted Source · CWE-697 Incorrect Comparison

← All critical vulnerabilities