am-mock-api-0.0.0.tgz: 1 vulnerabilities (highest severity is: 9.1)

[mend-for-github-com]

Vulnerable Library - am-mock-api-0.0.0.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: cb7b20c159ac2c1b8ff9453b332c9ed1e672d256

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (am-mock-api version)	Remediation Possible**
CVE-2026-90711	Critical	9.1	proxy-addr-2.0.7.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-90711

Vulnerable Library - proxy-addr-2.0.7.tgz

Determine address of proxied request

Library home page: https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• am-mock-api-0.0.0.tgz (Root Library)
  • express-5.2.1.tgz
    • ❌ proxy-addr-2.0.7.tgz (Vulnerable Library)

Found in HEAD commit: cb7b20c159ac2c1b8ff9453b332c9ed1e672d256

Found in base branch: main

Vulnerability Details

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This is a fail-open regression introduced in version 1.1.0. The issue is fixed in proxy-addr 2.0.8, and users should upgrade to 2.0.8 or later. As a workaround, ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.

Publish Date: 2026-09-15

URL: CVE-2026-90711

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-09-15

Fix Resolution: proxy-addr - 2.0.8,https://github.com/jshttp/proxy-addr.git - v2.0.8

[mend-for-github-com]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-for-github-com]

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.

[mend-for-github-com]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-for-github-com]

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.