---
id: "CVE-2026-77463"
page: "https://infrastack.ai/live/CVE-2026-77463"
kind: "vulnerability"
aliases: ["CVE-2026-77463"]
title: "Remark42: forged proxy headers bypass rate limits and vote checks"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["blogs", "package", "remark42", "self-hosted"]
not_affected_if: ["no-direct-internet-exposure", "trusted-proxy-configured", "version-1.16.2-or-later"]
published_at: "2026-11-05T21:18:53+00:00"
first_seen_at: "2026-11-05T21:40:45+00:00"
updated_at: "2026-11-05T21:41:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77463", "first_seen_at": "2026-11-05T21:40:45+00:00"}]
exploit_sources: []
---

# Remark42: forged proxy headers bypass rate limits and vote checks

Link for people: https://infrastack.ai/live/CVE-2026-77463 (this .md is for agents)

Remark42, a self-hosted blog comment engine, trusts client-supplied True-Client-IP, X-Real-IP and X-Forwarded-For headers without checking the sender is a trusted proxy. A remote attacker can rotate those headers to dodge per-IP rate limits and vote de-duplication, mint anonymous identities, and write fake IPs into stored comments and logs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Remark42 version in use: `remark42 --version` or the image tag; versions from `1.0.0` through `1.16.2` are affected.
- Check whether the deployment sets `--trusted-proxy`; if it is absent, the server trusts forwarding headers from any peer.
- Check whether `--votes-ip` is enabled, since vote de-duplication depends on the IP.

## Fix

- Remark42 `1.16.2` adds mitigation; the sources say operators must also configure `--trusted-proxy` for their topology.

## Timeline

- 2026-11-05T21:40:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77463

## Documents

- [advisory] Vendor advisory: github.com https://github.com/umputun/remark42/security/advisories/GHSA-56x6-q882-mf27
- [fix] Patch: github.com https://github.com/umputun/remark42/commit/b1502801facd7782a1c70fd51f8ad5c2eb650d39
- [fix] Patch: github.com https://github.com/umputun/remark42/commit/e62b3c830d81659cf5d2687b0c8261da7d42fdab
- [fix] Release notes: github.com https://github.com/umputun/remark42/releases/tag/backend/v1.16.2

## From the sources

Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. From 1.0.0 until 1.16.2, Remark42 globally trusts True-Client-IP, X-Real-IP, and X-Forwarded-For without verifying that the direct peer is a trusted proxy, and middleware.RealIP overwrites r.RemoteAddr before per-IP controls run. In a directly reachable deployment, or a proxy that forwards attacker-controlled headers, a remote attacker can rotate spoofed forwarding headers to obtain fresh token buckets for rate-limited endpoints, bypass vote de-duplication when --votes-ip is enabled, mint anonymous identities, and poison stored comment IPs and request logs. The global concurrent-request throttle and per-request timeouts still limit availability impact. Mitigation support is available in version 1.16.2, but operators must configure --trusted-proxy for the deployment topology.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_