High, CVSS 7.5npmAmendedPublished
express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network
CVE-2026-30827 · GHSA-46wh-pxpv-q5gq
- Affected
- npm express-rate-limit >= 8.2.0, < 8.2.2; >= 8.1.0, <= 8.1.0; >= 8.0.0, < 8.0.2
- Fixed in
- 8.0.28.1.18.2.2· Vendor fix available
- Issue
- The default keyGenerator in express-rate-limit applies IPv6 subnet masking (/56 by default) to all addresses that net.isIPv6() returns true for. This includes IPv4-mapped IPv6 addresses (::ffff:x.x.x.x), which Node.js returns as request.ip on dual-stack servers. Because the first 80 bits of all IPv4-mapped addresses are zero, a /56 (or any /32 to /80) subnet mask produces the same network key (::/56) for every IPv4 client. This collapses all IPv4 traffic into a single rate-limit bucket: one client exhausting the limit causes HTTP 429 for all other IPv4 clients. Details Root Cause In source/ip-key-generator.ts: net.isIPv6('::ffff:192.168.1.1') returns true, so IPv4-mapped addresses enter the subnet masking path. With a /56 prefix, the start address for any ::ffff:x.x.x.x is ::, producing the key ::/56. Proof of Concept End-to-End Validation On a dual-stack Express server (app.listen(port, '::')), tested with Express 5.2.1: - request.ip for IPv4 clients is ::ffff:127.0.0.1 -…
Recommended action: Upgrade to 8.2.2, 8.1.1 or 8.0.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.