deps: proxy-addr@^2.0.8 by lazerg · Pull Request #7474 · expressjs/express

lazerg · 2026-09-16T03:59:17Z

Bumps proxy-addr to ^2.0.8 to resolve CVE-2026-90711.

lazerg · 2026-09-16T04:01:00Z

The CI failure is because proxy-addr@2.0.8 was published less than 7 days ago and .npmrc blocks new packages. It will pass once the package is older.

# Context https://dsdmoj.atlassian.net/browse/SAS-1129 ### proxy-addr@2.0.7 https://github.com/ministryofjustice/hmpps-community-accommodation-tier-2-ui/security/code-scanning/178 Cannot fix this due to express not having the update yet, they will do so in around 7 days - expressjs/express#7474 So we can fix this right now by overriding the value first, then after 7 days updating express once they've got the update. ### undici@6.26.0 https://github.com/ministryofjustice/hmpps-community-accommodation-tier-2-ui/security/code-scanning/134 To fix undici I had to bump @types/node up a major version. After trying to run the build it failed for 1 place. I tried a few different fixes like bumping typescript or bumping the ts.config target version to 2022/24. but this creates more issues. So i resolved the one issue instead, next bump will likely require the rest of the typescript fixes.

lazerg · 2026-09-17T16:52:55Z

Checked again: same npm registry embargo, not a new problem. proxy-addr@2.0.8 was published 2026-09-15, so the install block lifts once it's 7 days old, around 2026-09-22. CI should clear on its own then, no code change needed here.

C-F-4 · 2026-09-23T05:50:09Z

Can we re-run the pipeline to validate if we are ready to roll this out, considering it's past 7 days now?

lazerg · 2026-09-23T05:58:39Z

All checks pass, including Lint and Node 24/25/26, which failed before. 🥳

lazerg · 2026-09-23T06:21:22Z

@Phillip9587 Could you take a look when you have time?

C-F-4 · 2026-09-28T11:07:47Z

Can this be merged and rolled out considering it's a critical vulnerability?
@Phillip9587 @lazerg @bjohansebas @UlisesGascon

krzysdz · 2026-09-28T12:01:02Z

FYI @C-F-4 you can update proxy-addr in your projects by running npm update proxy-addr. Running npm install without existing package-lock.json should also install proxy-addr@2.0.8.

Despite being marked as critical (which I don't think is right, the Confidentiality and Integrity impact in the CVSS in my opinion are set too high), it should not affect most projects, because only configurations where the developer accidentally set "trust proxy" with IPv4 mapped address with wrong mask are vulnerable. That is unless someone used ::ffff:10.0.0.0/8 (which is ::0-ff:ffff:ffff:ffff:ffff:ffff:ffff:ffff) instead of ::ffff:10.0.0.0/104 or something similar (IPv4 mask on IPv4 mapped address, which is IPv6) this does not affect them.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [express](https://expressjs.com/) ([source](https://github.com/expressjs/express)) | [`5.2.1` → `5.3.0`](https://renovatebot.com/diffs/npm/express/5.2.1/5.3.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/express/5.3.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/express/5.2.1/5.3.0?slim=true) | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/99) for more information. --- ### Release Notes <details> <summary>expressjs/express (express)</summary> ### [`v5.3.0`](https://github.com/expressjs/express/blob/HEAD/History.md#530) [Compare Source](expressjs/express@v5.2.1...v5.3.0) \===== #### 🐞 Bug fixes - Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by [@YuryShkoda](https://github.com/YuryShkoda) in [#4893](expressjs/express#4893) Fixed the behavior of `res.send()` to prevent conflicts between `Content-Length` and `Transfer-Encoding` HTTP headers in responses. The `Content-Length` header in `res.send()` is now only added when a `Transfer-Encoding` header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a `Transfer-Encoding` header - by [@cuishuang](https://github.com/cuishuang) in [#7459](expressjs/express#7459) * Upgrade `qs` to `^6.16.0`, which fixes [CVE-2026-2391](https://www.cve.org/CVERecord?id=CVE-2026-2391) ([GHSA-w7fw-mjwx-w883](GHSA-w7fw-mjwx-w883)), [CVE-2026-82417](https://www.cve.org/CVERecord?id=CVE-2026-82417) ([GHSA-4mjr-xmp4-gh2g](GHSA-4mjr-xmp4-gh2g)) and [CVE-2026-82562](https://www.cve.org/CVERecord?id=CVE-2026-82562) ([GHSA-x5fp-wj9c-mxmx](GHSA-x5fp-wj9c-mxmx)): `arrayLimit` bypasses in comma parsing and a denial of service via an attacker-controlled `isBuffer` - by [@davetashner](https://github.com/davetashner) in [#7057](expressjs/express#7057) and [#7478](expressjs/express#7478), and [@cyphercodes](https://github.com/cyphercodes) in [#7305](expressjs/express#7305) * Upgrade `proxy-addr` to `^2.0.8`, which fixes [CVE-2026-90711](https://www.cve.org/CVERecord?id=CVE-2026-90711) - by [@lazerg](https://github.com/lazerg) in [#7474](expressjs/express#7474) #### 🚀 Improvements - Allow conditional revalidation for QUERY requests. `req.fresh` previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by [@Cherry](https://github.com/Cherry) in [#7366](expressjs/express#7366) ```js // QUERY /reports with If-None-Match: "12345" app.query('/reports', (req, res) => { res.set('ETag', '"12345"'); res.send(results); // now responds 304 Not Modified }); ``` - Improve HTML structure in `res.redirect()` responses when HTML format is accepted by adding `<!DOCTYPE html>`, `<title>`, and `<body>` tags for better browser compatibility - by [@Bernice55231](https://github.com/Bernice55231) in [#5167](expressjs/express#5167) - When calling `app.render` with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by [AkaHarshit](https://github.com/AkaHarshit) in [#6903](expressjs/express#6903) ```js app.render('index', null, callback); // now works as expected ``` - Upgrade `content-type` to `^2.0.0`, bringing a faster parser (\~1.5x quicker `Content-Type` parsing/formatting in `res.send()`) along with a behavior change: `res.send()` now keeps any existing parameters when adding the charset and no longer throws on a `Content-Type` that fails to parse. `type-is` is upgraded to `^2.1.0` as part of the same change - by [@blakeembrey](https://github.com/blakeembrey) in [#7234](expressjs/express#7234) ```js res.set('Content-Type', 'text/plain; foo=bar').send('hey'); // -> Content-Type: text/plain; foo=bar; charset=utf-8 ``` - The default error handler now logs the full error object instead of only its stack trace, so nested details such as `Error.cause` and library-specific properties (e.g. Sequelize's `parent`/`original`) are no longer swallowed - by [@Nitin-Mohapatra](https://github.com/Nitin-Mohapatra) in [#6464](expressjs/express#6464) - Upgrade `content-disposition` to `^2.0.1`, which changes the `Content-Disposition` header emitted by `res.download()`, `res.attachment()`, and `res.sendFile()`: file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by [@blakeembrey](https://github.com/blakeembrey) in [#7233](expressjs/express#7233) ```js res.attachment('user.html'); // before -> Content-Disposition: attachment; filename="user.html" // after -> Content-Disposition: attachment; filename=user.html ``` - Upgrade `body-parser` to `^2.3.0`, which fixes [CVE-2026-12590](https://www.cve.org/CVERecord?id=CVE-2026-12590) ([GHSA-v422-hmwv-36x6](GHSA-v422-hmwv-36x6)): an invalid `limit` option value caused request body size enforcement to be silently disabled (fail-open), allowing a denial of service via arbitrarily large payloads. Invalid `limit` values now throw at parser initialization instead of being ignored - by [@Mayvis](https://github.com/Mayvis) in [#7390](expressjs/express#7390) #### ⚡ Performance - Avoid duplicate Content-Type header processing in `res.send()` when sending string responses without an explicit Content-Type header - by [@bjohansebas](https://github.com/bjohansebas) in [#6991](expressjs/express#6991) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "before 9am on tuesday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://code.futo.org/harbor/harbor/pulls/1812

deps: proxy-addr@^2.0.8

2e97498

krzysdz added 5.x deps labels Sep 16, 2026

simonwilson4moj mentioned this pull request Sep 16, 2026

chore sas 1129 bump package versions for vulns types node ministryofjustice/hmpps-community-accommodation-tier-2-ui#1130

Merged

bjohansebas approved these changes Sep 16, 2026

View reviewed changes

UlisesGascon approved these changes Sep 17, 2026

View reviewed changes

lazerg closed this Sep 23, 2026

lazerg reopened this Sep 23, 2026

bjohansebas merged commit 98bd4cd into expressjs:master Sep 28, 2026
63 of 77 checks passed

Navigation Menu

Repository navigation

deps: proxy-addr@^2.0.8 - #7474

deps: proxy-addr@^2.0.8#7474
bjohansebas merged 1 commit into
expressjs:masterfrom
lazerg:fix/issue-7473-proxy-addr

lazerg commented Sep 16, 2026

Uh oh!

lazerg commented Sep 16, 2026

Uh oh!

lazerg commented Sep 17, 2026

Uh oh!

C-F-4 commented Sep 23, 2026

Uh oh!

lazerg commented Sep 23, 2026 •

edited

Loading

Uh oh!

lazerg commented Sep 23, 2026 •

edited

Loading

Uh oh!

C-F-4 commented Sep 28, 2026

Uh oh!

krzysdz commented Sep 28, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

lazerg commented Sep 16, 2026

Uh oh!

lazerg commented Sep 16, 2026

Uh oh!

lazerg commented Sep 17, 2026

Uh oh!

C-F-4 commented Sep 23, 2026

Uh oh!

lazerg commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lazerg commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

C-F-4 commented Sep 28, 2026

Uh oh!

krzysdz commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

lazerg commented Sep 23, 2026 •

edited

Loading

lazerg commented Sep 23, 2026 •

edited

Loading

krzysdz commented Sep 28, 2026 •

edited

Loading