From f85019964575739cbf49f34803a2d5c2a6e2d014 Mon Sep 17 00:00:00 2001
From: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com>
Date: Tue, 6 Oct 2026 10:10:17 +0200
Subject: [PATCH] fix(ui): pin proxy-addr to 2.0.8 to patch the IP spoofing
 advisory (#12957)

---
 ui/changelog.d/proxy-addr-ip-spoofing.security.md | 1 +
 ui/pnpm-lock.yaml                                 | 9 +++++----
 ui/pnpm-workspace.yaml                            | 5 +++++
 3 files changed, 11 insertions(+), 4 deletions(-)
 create mode 100644 ui/changelog.d/proxy-addr-ip-spoofing.security.md

diff --git a/ui/changelog.d/proxy-addr-ip-spoofing.security.md b/ui/changelog.d/proxy-addr-ip-spoofing.security.md
new file mode 100644
index 0000000000..9574c50d16
--- /dev/null
+++ b/ui/changelog.d/proxy-addr-ip-spoofing.security.md
@@ -0,0 +1 @@
+`proxy-addr` to 2.0.8, patching IP spoofing through IPv4-mapped IPv6 trust subnets (GHSA-jqcg-44mw-7w3h)
diff --git a/ui/pnpm-lock.yaml b/ui/pnpm-lock.yaml
index 744f064f7b..c9966ddf43 100644
--- a/ui/pnpm-lock.yaml
+++ b/ui/pnpm-lock.yaml
@@ -44,6 +44,7 @@ overrides:
   ip-address: 10.3.1
   mermaid: 11.16.1
   body-parser: 2.3.0
+  proxy-addr: 2.0.8
   '@humanfs/node': 0.16.8
   js-yaml: 4.3.1
 
@@ -6164,8 +6165,8 @@ packages:
   property-information@7.1.0:
     resolution: {integrity: sha512-TwEZ+X+yCJmYfL7TPUOcvBZ4QfoT5YenQiJuX//0th53DE6w0xxLEtfK3iyryQFddXuvkIk51EEgrJQ0WJkOmQ==}
 
-  proxy-addr@2.0.7:
-    resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==}
+  proxy-addr@2.0.8:
+    resolution: {integrity: sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==}
     engines: {node: '>= 0.10'}
 
   proxy-from-env@1.1.0:
@@ -12002,7 +12003,7 @@ snapshots:
       on-finished: 2.4.1
       once: 1.4.0
       parseurl: 1.3.3
-      proxy-addr: 2.0.7
+      proxy-addr: 2.0.8
       qs: 6.16.0
       range-parser: 1.2.1
       router: 2.2.0
@@ -13794,7 +13795,7 @@ snapshots:
 
   property-information@7.1.0: {}
 
-  proxy-addr@2.0.7:
+  proxy-addr@2.0.8:
     dependencies:
       forwarded: 0.2.0
       ipaddr.js: 1.9.1
diff --git a/ui/pnpm-workspace.yaml b/ui/pnpm-workspace.yaml
index ab3e084e51..a6a70b20d4 100644
--- a/ui/pnpm-workspace.yaml
+++ b/ui/pnpm-workspace.yaml
@@ -107,6 +107,11 @@ overrides:
   "mermaid": "11.16.1"
   # body-parser (via express): invalid `limit` silently disabled size enforcement.
   "body-parser": "2.3.0"
+  # proxy-addr (via @modelcontextprotocol/sdk > express): GHSA-jqcg-44mw-7w3h
+  # (critical), a short IPv4-mapped IPv6 trust subnet trusts every client, so
+  # `req.ip` returns a spoofed X-Forwarded-For. 2.0.8 (2026-09-15) clears the
+  # 7-day cooldown gate.
+  "proxy-addr": "2.0.8"
   # @humanfs/node (via eslint): recursive copy followed symlinks outside the tree.
   "@humanfs/node": "0.16.8"
   # js-yaml: quadratic CPU in `!!omap` resolution (CVE-2026-59870 not backported