---
title: "proxy-addr security advisories"
description: "1 known security advisory for proxy-addr, with the versions they affect and the version that fixes each."
url: https://inlinr.com/packages/proxy-addr/security
lang: en
---

[Packages](https://inlinr.com/packages)

# proxy-addr

2.0.8 · 15 Sep 2026 MIT 156.6M / week [Repository](https://github.com/jshttp/proxy-addr) [Homepage](https://github.com/jshttp/proxy-addr#readme) [npm](https://www.npmjs.com/package/proxy-addr) [Atom feed](https://inlinr.com/packages/feed/proxy-addr)

Your version 

## Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

| Line | Newest | Where it stands                                                             |
| ---- | ------ | --------------------------------------------------------------------------- |
|      | 2.0.8  | Safe from 2.0.8                                                             |
|      | 1.1.5  | 1 open advisory, worst critical  · last release Jul 2017, no longer updated |

- Critical  
[proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet](https://inlinr.com/advisories/GHSA-jqcg-44mw-7w3h)GHSA-jqcg-44mw-7w3h · 5 Oct 2026  
fixed in 2.0.8

### Quality and security signals

What [npm](https://www.npmjs.com/package/proxy-addr) and [deps.dev](https://deps.dev/npm/proxy-addr) say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 4 Nov 2026\. Releases and advisories last read 4 Nov 2026.