Kagebunsher

**Name of the Vulnerable Software and Affected Versions** @fastify/jwt versions prior to 10.2.3 **Description** In the @fastify/jwt plugin for the Fastify web framework, the parser fails to handle certain time span formats passed to `expiresIn`, `notBefore`, or `maxAge`. Unsupported formats include compound spans, month units, ISO 8601 durations, decimal commas, or values with surrounding whitespace. These values are silently dropped rather than refused. During the signing process, this results in tokens without an expiration claim that never expire. During the verification process, the configured `maxAge` is not enforced, allowing tokens that should be rejected due to age to be accepted. **Recommendations** Update to version 10.2.3 or later. Pass the `expiresIn`, `notBefore`, or `maxAge` options as a number of seconds. Verify that any time-span string parses to a finite value before use.

**Name of the Vulnerable Software and Affected Versions** @fastify/proxy-addr versions 3.0.0 through 5.1.0 **Description** This plugin, used to determine a request's client address behind trusted reverse proxies, incorrectly handles trust subnets written in IPv4-mapped IPv6 notation when an IPv4-sized prefix is used (for example, ::ffff:10.0.0.0/8 instead of ::ffff:10.0.0.0/104). The software accepts these inputs without error but ends up trusting every IPv4 address on the internet. This allows an unauthenticated client to provide an arbitrary `X-Forwarded-For` header to control the address the application reads, bypassing IP-based access control, rate limiting, geolocation, and audit logging. **Recommendations** Update to version 5.1.1 or later. Ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.

**Name of the Vulnerable Software and Affected Versions** proxy-addr versions 1.1.0 through 2.0.7 **Description** This Node.js module, which determines a request's client address behind trusted reverse proxies and supports Express `req.ip` and `req.ips`, contains a flaw where trust subnets written in IPv4-mapped IPv6 notation with an IPv4-sized prefix (e.g., `::ffff:10.0.0.0/8` instead of `::ffff:10.0.0.0/104`) are accepted without error. This causes the module to trust every IPv4 address on the internet instead of the specified block. Consequently, an unauthenticated client can provide an arbitrary `X-Forwarded-For` header to control the address the application reads, bypassing IP-based access control, rate limiting, geolocation, and audit logging. **Recommendations** Update to version 2.0.8 or later. Ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97. Express the trust range in plain IPv4 notation.