diff --git a/changelog.d/+proxy-addr-cve-2026-90711.fixed.md b/changelog.d/+proxy-addr-cve-2026-90711.fixed.md
new file mode 100644
index 000000000..ae67f064d
--- /dev/null
+++ b/changelog.d/+proxy-addr-cve-2026-90711.fixed.md
@@ -0,0 +1 @@
+Bump the transitive `proxy-addr` dependency from 2.0.7 to 2.0.8 in every MCP package lockfile. Version 2.0.7 carries CVE-2026-90711 (CRITICAL): `proxy-addr` is vulnerable to IP spoofing through an IPv4-mapped IPv6 trust subnet. This cleared the critical finding reported by the dependency-audit and Trivy scans.
diff --git a/mcp/aptl-mcp-common/package-lock.json b/mcp/aptl-mcp-common/package-lock.json
index 296843e27..720d61ec1 100644
--- a/mcp/aptl-mcp-common/package-lock.json
+++ b/mcp/aptl-mcp-common/package-lock.json
@@ -2236,9 +2236,9 @@
             }
         },
         "node_modules/proxy-addr": {
-            "version": "2.0.7",
-            "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-            "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+            "version": "2.0.8",
+            "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
+            "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
             "license": "MIT",
             "dependencies": {
                 "forwarded": "0.2.0",
@@ -2246,6 +2246,10 @@
             },
             "engines": {
                 "node": ">= 0.10"
+            },
+            "funding": {
+                "type": "opencollective",
+                "url": "https://opencollective.com/express"
             }
         },
         "node_modules/qs": {
diff --git a/mcp/mcp-casemgmt/package-lock.json b/mcp/mcp-casemgmt/package-lock.json
index 1b0b83483..e51118c58 100644
--- a/mcp/mcp-casemgmt/package-lock.json
+++ b/mcp/mcp-casemgmt/package-lock.json
@@ -1733,7 +1733,9 @@
             }
         },
         "node_modules/proxy-addr": {
-            "version": "2.0.7",
+            "version": "2.0.8",
+            "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
+            "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
             "license": "MIT",
             "dependencies": {
                 "forwarded": "0.2.0",
@@ -1741,6 +1743,10 @@
             },
             "engines": {
                 "node": ">= 0.10"
+            },
+            "funding": {
+                "type": "opencollective",
+                "url": "https://opencollective.com/express"
             }
         },
         "node_modules/qs": {
diff --git a/mcp/mcp-indexer/package-lock.json b/mcp/mcp-indexer/package-lock.json
index 2441c0205..710b7c793 100644
--- a/mcp/mcp-indexer/package-lock.json
+++ b/mcp/mcp-indexer/package-lock.json
@@ -2800,9 +2800,9 @@
             }
         },
         "node_modules/proxy-addr": {
-            "version": "2.0.7",
-            "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-            "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+            "version": "2.0.8",
+            "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
+            "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
             "license": "MIT",
             "dependencies": {
                 "forwarded": "0.2.0",
@@ -2810,6 +2810,10 @@
             },
             "engines": {
                 "node": ">= 0.10"
+            },
+            "funding": {
+                "type": "opencollective",
+                "url": "https://opencollective.com/express"
             }
         },
         "node_modules/punycode": {
diff --git a/mcp/mcp-network/package-lock.json b/mcp/mcp-network/package-lock.json
index 2422eb969..a145add7c 100644
--- a/mcp/mcp-network/package-lock.json
+++ b/mcp/mcp-network/package-lock.json
@@ -1733,7 +1733,9 @@
             }
         },
         "node_modules/proxy-addr": {
-            "version": "2.0.7",
+            "version": "2.0.8",
+            "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
+            "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
             "license": "MIT",
             "dependencies": {
                 "forwarded": "0.2.0",
@@ -1741,6 +1743,10 @@
             },
             "engines": {
                 "node": ">= 0.10"
+            },
+            "funding": {
+                "type": "opencollective",
+                "url": "https://opencollective.com/express"
             }
         },
         "node_modules/qs": {
diff --git a/mcp/mcp-red/package-lock.json b/mcp/mcp-red/package-lock.json
index f63d46a77..4ab92d8bb 100644
--- a/mcp/mcp-red/package-lock.json
+++ b/mcp/mcp-red/package-lock.json
@@ -2982,9 +2982,9 @@
             }
         },
         "node_modules/proxy-addr": {
-            "version": "2.0.7",
-            "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-            "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+            "version": "2.0.8",
+            "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
+            "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
             "license": "MIT",
             "dependencies": {
                 "forwarded": "0.2.0",
@@ -2992,6 +2992,10 @@
             },
             "engines": {
                 "node": ">= 0.10"
+            },
+            "funding": {
+                "type": "opencollective",
+                "url": "https://opencollective.com/express"
             }
         },
         "node_modules/punycode": {
diff --git a/mcp/mcp-reverse/package-lock.json b/mcp/mcp-reverse/package-lock.json
index 8b7bf686e..b85c70bb5 100644
--- a/mcp/mcp-reverse/package-lock.json
+++ b/mcp/mcp-reverse/package-lock.json
@@ -2808,9 +2808,9 @@
             }
         },
         "node_modules/proxy-addr": {
-            "version": "2.0.7",
-            "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-            "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+            "version": "2.0.8",
+            "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
+            "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
             "license": "MIT",
             "dependencies": {
                 "forwarded": "0.2.0",
@@ -2818,6 +2818,10 @@
             },
             "engines": {
                 "node": ">= 0.10"
+            },
+            "funding": {
+                "type": "opencollective",
+                "url": "https://opencollective.com/express"
             }
         },
         "node_modules/punycode": {
diff --git a/mcp/mcp-soar/package-lock.json b/mcp/mcp-soar/package-lock.json
index f017b59df..daffc40f0 100644
--- a/mcp/mcp-soar/package-lock.json
+++ b/mcp/mcp-soar/package-lock.json
@@ -1733,7 +1733,9 @@
             }
         },
         "node_modules/proxy-addr": {
-            "version": "2.0.7",
+            "version": "2.0.8",
+            "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
+            "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
             "license": "MIT",
             "dependencies": {
                 "forwarded": "0.2.0",
@@ -1741,6 +1743,10 @@
             },
             "engines": {
                 "node": ">= 0.10"
+            },
+            "funding": {
+                "type": "opencollective",
+                "url": "https://opencollective.com/express"
             }
         },
         "node_modules/qs": {
diff --git a/mcp/mcp-threatintel/package-lock.json b/mcp/mcp-threatintel/package-lock.json
index fca6526e1..02cf9e598 100644
--- a/mcp/mcp-threatintel/package-lock.json
+++ b/mcp/mcp-threatintel/package-lock.json
@@ -1733,7 +1733,9 @@
             }
         },
         "node_modules/proxy-addr": {
-            "version": "2.0.7",
+            "version": "2.0.8",
+            "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
+            "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
             "license": "MIT",
             "dependencies": {
                 "forwarded": "0.2.0",
@@ -1741,6 +1743,10 @@
             },
             "engines": {
                 "node": ">= 0.10"
+            },
+            "funding": {
+                "type": "opencollective",
+                "url": "https://opencollective.com/express"
             }
         },
         "node_modules/qs": {
diff --git a/mcp/mcp-wazuh/package-lock.json b/mcp/mcp-wazuh/package-lock.json
index e171eacaa..6b608a3b3 100644
--- a/mcp/mcp-wazuh/package-lock.json
+++ b/mcp/mcp-wazuh/package-lock.json
@@ -1813,9 +1813,9 @@
             }
         },
         "node_modules/proxy-addr": {
-            "version": "2.0.7",
-            "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-            "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+            "version": "2.0.8",
+            "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
+            "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
             "license": "MIT",
             "dependencies": {
                 "forwarded": "0.2.0",
@@ -1823,6 +1823,10 @@
             },
             "engines": {
                 "node": ">= 0.10"
+            },
+            "funding": {
+                "type": "opencollective",
+                "url": "https://opencollective.com/express"
             }
         },
         "node_modules/qs": {