diff --git a/magicmirror.spec b/magicmirror.spec
index 75353d9bf54f8a7e3e5db51f87adaf5fcbf7dc13..056808c2a176826b750ce9ebfae3dc45872f8c15 100644
--- a/magicmirror.spec
+++ b/magicmirror.spec
@@ -4,7 +4,7 @@
 
 Name:           magicmirror
 Version:        2.26.0
-Release:    2%{?dist}
+Release:    3%{?dist}
 Summary:        Modular smart mirror platform
 
 License:        0BSD AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND (CC-BY-4.0 AND OFL-1.1 AND MIT) AND ISC AND MIT AND OFL-1.1 AND Python-2.0
@@ -112,6 +112,10 @@ ln -s custom.css.sample css/custom.css
 %{_unitdir}/%{name}.service
 
 %changelog
+* Sat Oct 10 2026 PkgAgent Robot <pkgagent@opencloudos.tech> - 2.26.0-3
+- [Type] security
+- [DESC] Fix CVE-2026-90711 (bundled proxy-addr 2.0.7 -> 2.0.8)
+
 * Wed Jun 11 2025 bbrucezhang <bbrucezhang@tencent.com> - 2.26.0-2
 - Rebuilt for loongarch64
 
diff --git a/sources b/sources
index e5fd3ddfae414907167b313aff4c1e16df13865f..6aa70e67e4bd4ae6f25a66d0d4486d8ac7e68ffe 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (MagicMirror-2.26.0-nm-dev.tgz) = 13ccc7f1cf5e38c02baf83cf993ac2180b6c9f63c136574b34f41f876e5e5c1bc8e9686d5f9c5845e400c399fe97b9e311f9dd9a18071335bab0b287e220d092
-SHA512 (MagicMirror-2.26.0-nm-prod.tgz) = fdfce16b5b71b178e859629723f63de87e84130821f12bfae6c8be306eb41ed768d175b97f8051428b84cec0a78320563fb07f1a8b5de0f44fc8593dd464ee22
+SHA512 (MagicMirror-2.26.0-nm-dev.tgz) = 9b05d0592403afb8d96ec41dcb644694f0988f4639f35de800fcb0004808b18236e22d27fcab8a4c4ebca13add315b37627dbaf7624c047bbcad2f9173940390
+SHA512 (MagicMirror-2.26.0-nm-prod.tgz) = b0dec5aeb3816d8da6db94260ef4e12d0ba40f52c9688b3aefb23f6ba690c2a1b7b75b4eb860529ac7d413118aee32f6bd3b8928b43834c3a726b2e7924111ba
 SHA512 (MagicMirror-2.26.0.tar.gz) = 3b56c79bbd92dba2653ba1ca04662034b37cb9adbba1ced60262922b0ac3801a4bd95626eda5ae462b9d02291696b4b2c4132ddbdfe384979040549155e36ff7