[abejarano]

What changed

• Resolve req.ip by walking X-Forwarded-For from the closest proxy to the first untrusted address.
• Add explicit trusted hop counts while preserving CIDR and custom trust policies.
• Fail closed when a forwarded chain contains malformed addresses.
• Normalize IPv4-mapped IPv6 addresses such as ::ffff:127.0.0.1 to IPv4.
• Implement real IPv4 and IPv6 CIDR matching with node:net.

Root cause

The Bun adapter trusted only the immediate socket and, once trusted, selected the leftmost forwarded address. Behind managed reverse proxies such as Cloud Run this either exposed the proxy address as req.ip or allowed a client-supplied prefix to be treated as the origin. IPv4-mapped IPv6 normalization also returned an empty string, and IPv6 CIDRs were compared as exact strings.

Impact

Applications can configure the exact number or identity of trusted proxy hops and receive a stable client IP without trusting spoofable forwarded prefixes. IPv4-mapped proxy addresses and IPv6 CIDR allowlists now behave correctly.

Validation

• bun run build
• bun run typecheck
• bun run test — 20 passed, 0 failed
• git diff --check
• Prettier check for the new test file

[abejarano]

🎉 This PR is included in version 1.1.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀