{"metadata": {"vulnerability": "CVE-2026-90711", "count": 74, "kinds": {"milestone": 8, "sighting": 6, "kev": 0, "other": 60}}, "data": [{"timestamp": "2026-03-20T22:23:32.147Z", "date_only": false, "value": "2026-03-20T22:23:32.147000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-03-20T23:02:27.802Z", "date_only": false, "value": "2026-03-20T23:02:27.802640+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2026-07-08T15:47:24.885Z", "date_only": false, "value": "2026-07-08T15:47:24.885000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "vulnerabilities.1.release_date"}, {"timestamp": "2026-07-08T17:02:16.432Z", "date_only": false, "value": "2026-07-08T17:02:16.432203+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "vulnerabilities.1.discovery_date"}, {"timestamp": "2026-08-03T16:56:25.733Z", "date_only": false, "value": "2026-08-03T16:56:25.733000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "vulnerabilities.2.release_date"}, {"timestamp": "2026-08-03T18:01:01.506Z", "date_only": false, "value": "2026-08-03T18:01:01.506065+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "vulnerabilities.2.discovery_date"}, {"timestamp": "2026-08-28T19:44:23.501Z", "date_only": false, "value": "2026-08-28T19:44:23.501000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-08-28T20:12:21.355Z", "date_only": false, "value": "2026-08-28T20:12:21.355000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "vulnerabilities.2.release_date"}, {"timestamp": "2026-08-28T22:01:52.103Z", "date_only": false, "value": "2026-08-28T22:01:52.103221+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2026-08-28T22:02:12.422Z", "date_only": false, "value": "2026-08-28T22:02:12.422600+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "vulnerabilities.2.discovery_date"}, {"timestamp": "2026-09-10T17:59:35.845Z", "date_only": false, "value": "2026-09-10T17:59:35.845000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "vulnerabilities.5.release_date"}, {"timestamp": "2026-09-10T18:11:27.321Z", "date_only": false, "value": "2026-09-10T18:11:27.321656+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "vulnerabilities.5.discovery_date"}, {"timestamp": "2026-09-11T11:24:55.150Z", "date_only": false, "value": "2026-09-11T11:24:55.150000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "vulnerabilities.4.release_date"}, {"timestamp": "2026-09-11T11:40:59Z", "date_only": false, "value": "2026-09-11T11:40:59.000487+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "vulnerabilities.4.discovery_date"}, {"timestamp": "2026-09-13T09:18:12.590Z", "date_only": false, "value": "2026-09-13T09:18:12.590Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-90711", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-14T16:11:41.401Z", "date_only": false, "value": "2026-09-14T16:11:41.401000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "vulnerabilities.3.release_date"}, {"timestamp": "2026-09-14T16:22:17.356Z", "date_only": false, "value": "2026-09-14T16:22:17.356407+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "vulnerabilities.3.discovery_date"}, {"timestamp": "2026-09-15T06:19:46.332Z", "date_only": false, "value": "2026-09-15T06:19:46.332Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-90711", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-15T06:19:46.332Z", "date_only": false, "value": "2026-09-15T06:19:46.332000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "vulnerabilities.6.release_date"}, {"timestamp": "2026-09-15T06:19:46.332Z", "date_only": false, "value": "2026-09-15T06:19:46.332000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "vulnerabilities.3.release_date"}, {"timestamp": "2026-09-15T06:19:46.332Z", "date_only": false, "value": "2026-09-15T06:19:46.332Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / openjs", "record": "CVE-2026-90711", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-15T06:25:30.064Z", "date_only": false, "value": "2026-09-15T06:25:30.064221Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3mvjyiyxt2c25", "record": "CVE-2026-90711", "field": "creation_timestamp", "uuid": "e68ca7a6-2751-40e6-82b2-f02ad28b2630", "content": "\ud83d\udea8 Critical-severity security fix in proxy-addr@2.0.8 just released!\n\nPatches CVE-2026-90711: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet\n\ngithub.com/jshttp/proxy...", "url": "https://bsky.app/profile/ulisesgascon.com/post/3mvjyiyxt2c25"}, {"timestamp": "2026-09-15T06:41:11.029Z", "date_only": false, "value": "2026-09-15T06:41:11.029083+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "vulnerabilities.6.discovery_date"}, {"timestamp": "2026-09-15T06:41:11.029Z", "date_only": false, "value": "2026-09-15T06:41:11.029083+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "vulnerabilities.3.discovery_date"}, {"timestamp": "2026-09-15T07:00:07.620Z", "date_only": false, "value": "2026-09-15T07:00:07.620090Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvk2gwc42v2t", "record": "CVE-2026-90711", "field": "creation_timestamp", "uuid": "48c13374-a81e-465e-962a-bca28cc28981", "content": "CVE-2026-90711 - proxy-addr\nThe proxy-addr component used by Node.js web apps can mistakenly trust all Internet addresses when a specific network range is written in a mixed IPv4/IPv6 format. This lets an attacker\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#proxyaddr #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mvk2gwc42v2t"}, {"timestamp": "2026-09-15T07:16:00Z", "date_only": false, "value": "2026-09-15T07:16:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-90711", "record": "UBUNTU-CVE-2026-90711", "field": "published"}, {"timestamp": "2026-09-15T07:16:33Z", "date_only": false, "value": "2026-09-15T07:16:33Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-JQCG-44MW-7W3H", "record": "GHSA-JQCG-44MW-7W3H", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-15T07:16:33.683Z", "date_only": false, "value": "2026-09-15T07:16:33.683", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-90711", "record": "FKIE_CVE-2026-90711", "field": "published"}, {"timestamp": "2026-09-15T08:00:48.965Z", "date_only": false, "value": "2026-09-15T08:00:48.965067Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvk5tgflif2r", "record": "CVE-2026-90711", "field": "creation_timestamp", "uuid": "76d19fef-ce2a-4337-9cad-a77badd5c8c5", "content": "\ud83d\udd34 CVE-2026-90711 - Critical (9.1)\n\nproxy-addr is a Node.js module that determines a request's client address behind trusted reverse ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-90711/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvk5tgflif2r"}, {"timestamp": "2026-09-15T08:07:07.206Z", "date_only": false, "value": "2026-09-15T08:07:07.206473Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvk66preyc2f", "record": "CVE-2026-90711", "field": "creation_timestamp", "uuid": "ab7f8e72-7198-43be-8f9d-bf5f9569eaf6", "content": "\ud83d\udea8 CVE-2026-90711 \u2014 CVSS 9.1 CRITICAL\n\nproxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, a...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-90711\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mvk66preyc2f"}, {"timestamp": "2026-09-15T14:46:09.894Z", "date_only": false, "value": "2026-09-15T14:46:09.894513Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-90711", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-15T14:46:09.894Z", "date_only": false, "value": "2026-09-15T14:46:09.894513Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-90711", "record": "FKIE_CVE-2026-90711", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-15T14:48:38.703Z", "date_only": false, "value": "2026-09-15T14:48:38.703Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-90711", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-15T14:48:38.703Z", "date_only": false, "value": "2026-09-15T14:48:38.703Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-90711", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-16T01:17:53.098Z", "date_only": false, "value": "2026-09-16T01:17:53.098988Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mvlxru7or42t", "record": "CVE-2026-90711", "field": "creation_timestamp", "uuid": "21985f7a-f1b4-4397-af56-79095683a9ad", "content": "A critical proxy-addr IP spoofing flaw (CVE-2026-90711) exposes Node.js apps to access control bypasses. Patch this proxy-addr IP spoofing bug today.\n\n#ProxyAddr #NodeJS #IPspoofing #CVE202690711 #Cybersecurity", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mvlxru7or42t"}, {"timestamp": "2026-09-16T19:40:00.317Z", "date_only": false, "value": "2026-09-16T19:40:00.317", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-90711", "record": "FKIE_CVE-2026-90711", "field": "lastModified"}, {"timestamp": "2026-09-16T21:47:03.073Z", "date_only": false, "value": "2026-09-16T21:47:03.073000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "vulnerabilities.7.release_date"}, {"timestamp": "2026-09-17T13:46:13.508Z", "date_only": false, "value": "2026-09-17T13:46:13.508000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "vulnerabilities.4.release_date"}, {"timestamp": "2026-09-17T13:51:33.999Z", "date_only": false, "value": "2026-09-17T13:51:33.999468+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "vulnerabilities.4.discovery_date"}, {"timestamp": "2026-09-18T16:38:47.064Z", "date_only": false, "value": "2026-09-18T16:38:47.064000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "vulnerabilities.1.release_date"}, {"timestamp": "2026-09-18T17:51:34.972Z", "date_only": false, "value": "2026-09-18T17:51:34.972000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "vulnerabilities.8.release_date"}, {"timestamp": "2026-09-18T17:51:34.972Z", "date_only": false, "value": "2026-09-18T17:51:34.972000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "vulnerabilities.5.release_date"}, {"timestamp": "2026-09-22T18:14:09.954Z", "date_only": false, "value": "2026-09-22T18:14:09.954827+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "vulnerabilities.7.discovery_date"}, {"timestamp": "2026-09-22T18:17:34.349Z", "date_only": false, "value": "2026-09-22T18:17:34.349880+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "vulnerabilities.8.discovery_date"}, {"timestamp": "2026-09-22T18:17:34.349Z", "date_only": false, "value": "2026-09-22T18:17:34.349880+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "vulnerabilities.5.discovery_date"}, {"timestamp": "2026-09-22T21:58:07.363Z", "date_only": false, "value": "2026-09-22T21:58:07.363582+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "vulnerabilities.1.discovery_date"}, {"timestamp": "2026-09-29T00:36:59.013Z", "date_only": false, "value": "2026-09-29T00:36:59.013245Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-CT50806", "record": "CLEANSTART-2026-CT50806", "field": "published"}, {"timestamp": "2026-09-30T19:44:47.303Z", "date_only": false, "value": "2026-09-30T19:44:47.303000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "vulnerabilities.7.release_date"}, {"timestamp": "2026-09-30T19:51:03.342Z", "date_only": false, "value": "2026-09-30T19:51:03.342149+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "vulnerabilities.7.discovery_date"}, {"timestamp": "2026-10-05T17:00:00.250Z", "date_only": false, "value": "2026-10-05T17:00:00.250000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "vulnerabilities.6.release_date"}, {"timestamp": "2026-10-05T17:11:38.925Z", "date_only": false, "value": "2026-10-05T17:11:38.925127+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "vulnerabilities.6.discovery_date"}, {"timestamp": "2026-10-05T23:30:26Z", "date_only": false, "value": "2026-10-05T23:30:26Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-JQCG-44MW-7W3H", "record": "GHSA-JQCG-44MW-7W3H", "field": "published"}, {"timestamp": "2026-10-05T23:30:27Z", "date_only": false, "value": "2026-10-05T23:30:27Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-JQCG-44MW-7W3H", "record": "GHSA-JQCG-44MW-7W3H", "field": "modified"}, {"timestamp": "2026-10-06T21:32:25.997Z", "date_only": false, "value": "2026-10-06T21:32:25.997000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "vulnerabilities.8.release_date"}, {"timestamp": "2026-10-06T21:37:33.675Z", "date_only": false, "value": "2026-10-06T21:37:33.675000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "vulnerabilities.9.release_date"}, {"timestamp": "2026-10-06T21:51:39.882Z", "date_only": false, "value": "2026-10-06T21:51:39.882210+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "vulnerabilities.8.discovery_date"}, {"timestamp": "2026-10-06T21:52:45.886Z", "date_only": false, "value": "2026-10-06T21:52:45.886561+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "vulnerabilities.9.discovery_date"}, {"timestamp": "2026-10-08T15:17:50Z", "date_only": false, "value": "2026-10-08T15:17:50Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-CT50806", "record": "CLEANSTART-2026-CT50806", "field": "modified"}, {"timestamp": "2026-10-17T09:57:07Z", "date_only": false, "value": "2026-10-17T09:57:07Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-90711", "record": "UBUNTU-CVE-2026-90711", "field": "modified"}, {"timestamp": "2026-10-18T21:17:42Z", "date_only": false, "value": "2026-10-18T21:17:42.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/fritjofherrstrom-png/b1aa68acd190b4ea2dacd70478bb8775", "record": "CVE-2026-90711", "field": "creation_timestamp", "uuid": "c10875c6-8aa0-41b5-8af4-a61af9fc0ed5", "content": "# Avgr\u00e4nsad kontroll av npm-varningen\n\nDatum: 2026-10-18. Kandidat: `5fed528d8b9524e8fc6936ee4d08d24e982919b5`.\nFryst bas: `25e688391c874efca6969cba729cba816efc41d1`.\nRepo: `/Users/fritjof/Developer/parranda-branches/codex-pr617-review-fixes-20261017`.\n\n`npm audit --omit=dev --json` k\u00f6rdes exakt en g\u00e5ng, utan installation, fix eller retry.\nResultatet finns i `npm-audit-omit-dev.json`. Exitkod 1 avser de rapporterade\ns\u00e5rbarheterna: 2 paket (1 moderate, 1 critical), sammanlagt 3 advisories.\nDet \u00f6verensst\u00e4mmer med varningen i `candidate-image-build.log:188`.\n\n## Of\u00f6r\u00e4ndrade beroenden\n\n`git diff --exit-code BASE HEAD -- package.json package-lock.json frontend/package.json frontend/package-lock.json`\ngav exitkod 0. B\u00e5da revisionerna har exakt samma git-blobbar:\n\n| Fil | Blob i bas och kandidat |\n| --- | --- |\n| package.json | a17ddf05d80ccf143e0a9149cde55e6b45016189 |\n| package-lock.json | f93f94fc13af7bd17a1133db1bde455a07bd73eb |\n| frontend/package.json | dd5eb4373a6b0ef530589de5d9bc10e975ca5f24 |\n| frontend/package-lock.json | 0fa46f1da8a479ddf583344316b9e91fa8139aae |\n\nDetta visar att paketmanifest och l\u00e5st beroendegraf \u00e4r identiska mot basen.\nFynden introducerades allts\u00e5 inte av PR628. Den lokala installerade versionen\nst\u00e4mmer ocks\u00e5 med l\u00e5set f\u00f6r express 5.2.1, body-parser 2.3.0, proxy-addr 2.0.7\noch qs 6.15.3. Runtimeimagen inspekterades inte inom denna kontroll.\n\n## Paket, villkor och anv\u00e4ndningsv\u00e4g\n\n* **proxy-addr 2.0.7, critical:**\n  [GHSA-jqcg-44mw-7w3h / CVE-2026-90711](https://github.com/advisories/GHSA-jqcg-44mw-7w3h).\n  P\u00e5verkat intervall `>=1.1.0 <2.0.8`; fixad version 2.0.8. Advisoryn g\u00e4ller\n  felaktigt betrodda IPv4-adresser n\u00e4r en app anv\u00e4nder vissa IPv6-/IPv4-mappade\n  trust-subn\u00e4t, vilket kan l\u00e5ta angriparstyrd X-Forwarded-For styra klient-IP.\n  Beroendev\u00e4g: Parranda \u2192 express 5.2.1 \u2192 proxy-addr 2.0.7.\n  Express anv\u00e4nder paketet f\u00f6r request.ip/ips (`node_modules/express/lib/request.js:327,344`).\n  Appen skapas i `server/app.js:1540`, utan trust-proxy-override; Express har\n  `trust proxy = false` som standard (`node_modules/express/lib/application.js:99`).\n  S\u00f6kning i server/server.js/scripts hittade ingen s\u00e5dan konfiguration eller\n  produktanv\u00e4ndning av request.ip/ips. Appens publika begr\u00e4nsare r\u00e4knar sj\u00e4lv\n  socket-/headeridentitet (`server/lib/public-access-guard.js:81-99,224-227`),\n  utan proxy-addr eller trust-subn\u00e4t. Advisoryns n\u00f6dv\u00e4ndiga villkor \u00e5terfanns inte.\n\n* **qs 6.15.3, moderate:** tv\u00e5 advisories, b\u00e5da fixade i 6.16.0.\n  [GHSA-x5fp-wj9c-mxmx / CVE-2026-82562](https://github.com/advisories/GHSA-x5fp-wj9c-mxmx)\n  g\u00e4ller array-limit-bypass i bracketnycklar med `comma: true` (p\u00e5verkat\n  `>=6.14.2 <=6.15.3`).\n  [GHSA-4mjr-xmp4-gh2g / CVE-2026-82417](https://github.com/advisories/GHSA-4mjr-xmp4-gh2g)\n  g\u00e4ller TypeError i qs.stringify n\u00e4r angriparstyrd constructor.isBuffer inte\n  \u00e4r en funktion (p\u00e5verkat `>=2.2.5 <6.16.0`); en parse\u2192stringify-runda kan skapa\n  formen om plainObjects/allowPrototypes till\u00e5ts.\n  Beroendev\u00e4gar: Parranda \u2192 express \u2192 qs och Parranda \u2192 express \u2192 body-parser \u2192 qs.\n  Parranda anv\u00e4nder express.json (`server/app.js:1543`); ingen urlencoded-middleware,\n  qs.parse/qs.stringify eller query-parser-override hittades i produktk\u00e4llorna.\n  Express standard \u00e4r query parser `simple` (`node_modules/express/lib/application.js:97`),\n  som anv\u00e4nder Node querystring.parse (`node_modules/express/lib/utils.js:169-177`).\n  qs anv\u00e4nds av Express f\u00f6rst i extended-parsern, respektive av body-parser i\n  urlencoded-parsern. Ingen aktiv v\u00e4g till de beskrivna advisoryvillkoren hittades.\n\n## Bed\u00f6mning och gr\u00e4ns\n\nSeparat befintligt beroendefynd att hantera utanf\u00f6r det frysta runtimeprovet.\nDen avgr\u00e4nsade statiska genomg\u00e5ngen visar inget uppenbart aktuellt exploaterbart\nfel via dessa tre advisories i aktiv produktkod. Detta \u00e4r ingen generell\ns\u00e4kerhetsgaranti: inga exploitf\u00f6rs\u00f6k eller \u00e4ndringar gjordes, runtimekonfiguration\noch andra orelaterade angreppsv\u00e4gar granskades inte, och inget resultat tillskrivs\nandra heads eller deployer. Ingen produktprovider anropades.\n\nRepo-head och arbetskopia var of\u00f6r\u00e4ndrade efter kontrollen. Ingen produkt\u00e4ndring,\ndependency-fix, installation, head-/runtime\u00e4ndring eller bred s\u00e4kerhetsgranskning.\n\n\n{\n  \"auditReportVersion\": 2,\n  \"vulnerabilities\": {\n    \"proxy-addr\": {\n      \"name\": \"proxy-addr\",\n      \"severity\": \"critical\",\n      \"isDirect\": false,\n      \"via\": [\n        {\n          \"source\": 1241210,\n          \"name\": \"proxy-addr\",\n          \"dependency\": \"proxy-addr\",\n          \"title\": \"proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet\",\n          \"url\": \"https://github.com/advisories/GHSA-jqcg-44mw-7w3h\",\n          \"severity\": \"critical\",\n          \"cwe\": [\n            \"CWE-290\",\n            \"CWE-348\",\n            \"CWE-697\"\n          ],\n          \"cvss\": {\n            \"score\": 9.1,\n            \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\"\n          },\n          \"range\": \">=1.1.0 <2.0.8\"\n        }\n      ],\n      \"effects\": [],\n      \"range\": \"1.1.0 - 2.0.7\",\n      \"nodes\": [\n        \"node_modules/proxy-addr\"\n      ],\n      \"fixAvailable\": true\n    },\n    \"qs\": {\n      \"name\": \"qs\",\n      \"severity\": \"moderate\",\n      \"isDirect\": false,\n      \"via\": [\n        {\n          \"source\": 1158506,\n          \"name\": \"qs\",\n          \"dependency\": \"qs\",\n          \"title\": \"qs array-limit bypass via bracket-key comma parsing\",\n          \"url\": \"https://github.com/advisories/GHSA-x5fp-wj9c-mxmx\",\n          \"severity\": \"moderate\",\n          \"cwe\": [\n            \"CWE-770\"\n          ],\n          \"cvss\": {\n            \"score\": 3.7,\n            \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L\"\n          },\n          \"range\": \">=6.14.2 <=6.15.3\"\n        },\n        {\n          \"source\": 1158507,\n          \"name\": \"qs\",\n          \"dependency\": \"qs\",\n          \"title\": \"qs: Denial of Service via Attacker Controlled isBuffer\",\n          \"url\": \"https://github.com/advisories/GHSA-4mjr-xmp4-gh2g\",\n          \"severity\": \"moderate\",\n          \"cwe\": [\n            \"CWE-248\",\n            \"CWE-703\"\n          ],\n          \"cvss\": {\n            \"score\": 5.3,\n            \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\"\n          },\n          \"range\": \">=2.2.5 <6.16.0\"\n        }\n      ],\n      \"effects\": [],\n      \"range\": \"2.2.5 - 6.15.3\",\n      \"nodes\": [\n        \"node_modules/qs\"\n      ],\n      \"fixAvailable\": true\n    }\n  },\n  \"metadata\": {\n    \"vulnerabilities\": {\n      \"info\": 0,\n      \"low\": 0,\n      \"moderate\": 1,\n      \"high\": 0,\n      \"critical\": 1,\n      \"total\": 2\n    },\n    \"dependencies\": {\n      \"prod\": 129,\n      \"dev\": 1,\n      \"optional\": 21,\n      \"peer\": 0,\n      \"peerOptional\": 0,\n      \"total\": 150\n    }\n  }\n}\n", "url": "https://gist.github.com/fritjofherrstrom-png/b1aa68acd190b4ea2dacd70478bb8775"}, {"timestamp": "2026-10-20T08:18:40Z", "date_only": false, "value": "2026-10-20T08:18:40+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-20T08:18:40Z", "date_only": false, "value": "2026-10-20T08:18:40+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-10-20T08:18:40Z", "date_only": false, "value": "2026-10-20T08:18:40+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-20T08:18:45Z", "date_only": false, "value": "2026-10-20T08:18:45+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-21T07:25:30Z", "date_only": false, "value": "2026-10-21T07:25:30+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-21T07:25:30Z", "date_only": false, "value": "2026-10-21T07:25:30+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-10-21T07:25:30Z", "date_only": false, "value": "2026-10-21T07:25:30+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-21T07:25:31Z", "date_only": false, "value": "2026-10-21T07:25:31+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-21T08:50:49Z", "date_only": false, "value": "2026-10-21T08:50:49+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-21T08:50:49Z", "date_only": false, "value": "2026-10-21T08:50:49+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-21T08:50:49Z", "date_only": false, "value": "2026-10-21T08:50:49+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:85846", "record": "RHSA-2026:85846", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-21T08:50:50Z", "date_only": false, "value": "2026-10-21T08:50:50+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-21T08:50:50Z", "date_only": false, "value": "2026-10-21T08:50:50+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-21T08:50:50Z", "date_only": false, "value": "2026-10-21T08:50:50+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:86675", "record": "RHSA-2026:86675", "field": "document.tracking.current_release_date"}]}