DRUPAL-CONTRIB-2025-111

The advisory, in context

This module allows you to specify an HTTP header name to determine the client's IP address.

The module doesn't sufficiently handle all cases under the scenario if Drupal Core settings $settings['reverse_proxy'] is set to TRUE and $settings['reverse_proxy_addresses'] is configured.

This vulnerability allows an attacker to spoof a request IP address (as Drupal sees it), potentially bypassing a variety of controls.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

drupal/reverse_proxy_header Packagist:https://packages.drupal.org/8

Ecosystem versions

Earlier releases before 1.1.2

Fixed in 1.1.2

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.1.2"
        }
      ],
      "type": "ECOSYSTEM",
      "database_specific": {
        "constraint": "<1.1.2"
      }
    }
  ],
  "versions": []
}

drupal/reverse_proxy_header Packagist