proxy-addr / @fastify/proxy-addr IPv4-mapped IPv6 trust subnet matches all IPv4 addresses

#!/usr/bin/env bash
# check_proxy_addr.sh — Verify proxy-addr version for CVE-2026-92395 / CVE-2026-90711
# Usage: bash check_proxy_addr.sh /path/to/node/app
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

APP_DIR="${1:-.}"
FIXED_MAJOR=2
FIXED_MINOR=0
FIXED_PATCH=8

# Try package-lock.json first, then node_modules
if [ -f "$APP_DIR/package-lock.json" ]; then
  VERSION=$(python3 -c "
import json, sys
with open('$APP_DIR/package-lock.json') as f:
    lock = json.load(f)
# lockfile v2/v3
for key, val in lock.get('packages', {}).items():
    if key.endswith('/proxy-addr') or key.endswith('/@fastify/proxy-addr'):
        print(val.get('version', ''))
        sys.exit(0)
# lockfile v1
for key, val in lock.get('dependencies', {}).items():
    if key in ('proxy-addr', '@fastify/proxy-addr'):
        print(val.get('version', ''))
        sys.exit(0)
print('')
" 2>/dev/null)
elif [ -f "$APP_DIR/node_modules/proxy-addr/package.json" ]; then
  VERSION=$(python3 -c "
import json
with open('$APP_DIR/node_modules/proxy-addr/package.json') as f:
    print(json.load(f).get('version', ''))
" 2>/dev/null)
elif [ -f "$APP_DIR/node_modules/@fastify/proxy-addr/package.json" ]; then
  VERSION=$(python3 -c "
import json
with open('$APP_DIR/node_modules/@fastify/proxy-addr/package.json') as f:
    print(json.load(f).get('version', ''))
" 2>/dev/null)
else
  echo "UNKNOWN — proxy-addr not found in $APP_DIR"
  exit 2
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not determine proxy-addr version"
  exit 2
fi

# Parse semver
IFS='.' read -r MAJOR MINOR PATCH <<< "$(echo "$VERSION" | sed 's/[^0-9.]//g')"
MAJOR=${MAJOR:-0}; MINOR=${MINOR:-0}; PATCH=${PATCH:-0}

echo "proxy-addr version: $VERSION"

if [ "$MAJOR" -gt "$FIXED_MAJOR" ] || \
   { [ "$MAJOR" -eq "$FIXED_MAJOR" ] && [ "$MINOR" -gt "$FIXED_MINOR" ]; } || \
   { [ "$MAJOR" -eq "$FIXED_MAJOR" ] && [ "$MINOR" -eq "$FIXED_MINOR" ] && [ "$PATCH" -ge "$FIXED_PATCH" ]; }; then
  echo "PATCHED — proxy-addr $VERSION >= 2.0.8"
  exit 0
else
  echo "VULNERABLE — proxy-addr $VERSION < 2.0.8 (CVE-2026-92395)"
  # Bonus: check for the actual misconfiguration in source
  echo ""
  echo "Checking for IPv4-mapped IPv6 trust config in source files..."
  HITS=$(grep -rn '::ffff:' "$APP_DIR/" --include='*.js' --include='*.ts' --include='*.mjs' --include='*.cjs' 2>/dev/null | grep -i 'trust\|proxy' || true)
  if [ -n "$HITS" ]; then
    echo "WARNING — Found IPv4-mapped IPv6 trust configuration:"
    echo "$HITS"
    echo ""
    echo "VULNERABLE — version is affected AND suspicious trust config found"
  else
    echo "Note: No IPv4-mapped IPv6 trust config found in source (may not be exploitable)"
    echo "VULNERABLE — version is affected but exploitability depends on trust config"
  fi
  exit 1
fi