From 4d0865d6b74b424a3a48f15ae13b529d65d4ef20 Mon Sep 17 00:00:00 2001
From: Steve-Mcl <sdmclaughlin@gmail.com>
Date: Tue, 6 Oct 2026 10:41:32 +0100
Subject: [PATCH] chore: Bump proxy-addr and @fastify/proxy-addr for
 CVE-2026-90711

proxy-addr 2.0.8 fixes IP spoofing via IPv4-mapped IPv6 trust subnets
(GHSA-jqcg-44mw-7w3h). @fastify/proxy-addr, the fork fastify uses, had
the same bug and was fixed in 5.1.1, but the advisory doesn't list it.
Both parents' ranges already allow the fixed versions, so only the
lockfile changes.

Clears https://github.com/FlowFuse/flowfuse/security/code-scanning/295
---
 package-lock.json | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index c38e75b819..1b68e27dcd 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3340,9 +3340,9 @@
             "license": "MIT"
         },
         "node_modules/@fastify/proxy-addr": {
-            "version": "5.1.0",
-            "resolved": "https://registry.npmjs.org/@fastify/proxy-addr/-/proxy-addr-5.1.0.tgz",
-            "integrity": "sha512-INS+6gh91cLUjB+PVHfu1UqcB76Sqtpyp7bnL+FYojhjygvOPA9ctiD/JDKsyD9Xgu4hUhCSJBPig/w7duNajw==",
+            "version": "5.1.1",
+            "resolved": "https://registry.npmjs.org/@fastify/proxy-addr/-/proxy-addr-5.1.1.tgz",
+            "integrity": "sha512-zv07Y9GEuDsJPegZoDFd4SDWaZOW8N2pa0GSrYmKpId/tjt1Hgo3BjZBVjdVpfVrHaA+Qv5jawtS2O50J5xM9g==",
             "funding": [
                 {
                     "type": "github",
@@ -21614,15 +21614,20 @@
             }
         },
         "node_modules/proxy-addr": {
-            "version": "2.0.7",
-            "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-            "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+            "version": "2.0.8",
+            "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
+            "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
+            "license": "MIT",
             "dependencies": {
                 "forwarded": "0.2.0",
                 "ipaddr.js": "1.9.1"
             },
             "engines": {
                 "node": ">= 0.10"
+            },
+            "funding": {
+                "type": "opencollective",
+                "url": "https://opencollective.com/express"
             }
         },
         "node_modules/proxy-agent-negotiate": {
@@ -29610,9 +29615,9 @@
             }
         },
         "@fastify/proxy-addr": {
-            "version": "5.1.0",
-            "resolved": "https://registry.npmjs.org/@fastify/proxy-addr/-/proxy-addr-5.1.0.tgz",
-            "integrity": "sha512-INS+6gh91cLUjB+PVHfu1UqcB76Sqtpyp7bnL+FYojhjygvOPA9ctiD/JDKsyD9Xgu4hUhCSJBPig/w7duNajw==",
+            "version": "5.1.1",
+            "resolved": "https://registry.npmjs.org/@fastify/proxy-addr/-/proxy-addr-5.1.1.tgz",
+            "integrity": "sha512-zv07Y9GEuDsJPegZoDFd4SDWaZOW8N2pa0GSrYmKpId/tjt1Hgo3BjZBVjdVpfVrHaA+Qv5jawtS2O50J5xM9g==",
             "requires": {
                 "@fastify/forwarded": "^3.0.0",
                 "ipaddr.js": "^2.1.0"
@@ -41612,9 +41617,9 @@
             }
         },
         "proxy-addr": {
-            "version": "2.0.7",
-            "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-            "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+            "version": "2.0.8",
+            "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
+            "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
             "requires": {
                 "forwarded": "0.2.0",
                 "ipaddr.js": "1.9.1"