So X-Forwarded-For header can be exploited with this library if we add XFF header in the request.
On Nginx, we can use the alternative X-Real-IP header for $remote_addr value.

Maybe we can add something like below?

app.use( clientIp.mw({ prioritize: ["x-real-ip",], }) );

This will push change header priority list from default
[ 'x-client-ip', 'x-forwarded-for', 'cf-connecting-ip', 'fastly-client-ip', 'true-client-ip', 'x-real-ip', 'x-cluster-client-ip', 'x-forwarded', 'forwarded-for', 'forwarded', 'x-appengine-user-ip', ];

to

[ 'x-real-ip', 'x-client-ip', 'x-forwarded-for', 'cf-connecting-ip', 'fastly-client-ip', 'true-client-ip', 'x-cluster-client-ip', 'x-forwarded', 'forwarded-for', 'forwarded', 'x-appengine-user-ip', ];