Rate Limiting Middleware Issue in Express by Express Rate Limit

CVE-2026-126204

What is CVE-2026-126204?

The express-rate-limit middleware has a vulnerability where the MemoryStore retains a mutable resetTime object for clients. In versions 8.6.0 through 8.7.2, when a new request resets a client window, it can unintentionally allow requests that are still in-flight to decrement the window's count. This results in an additional unauthorized burst of traffic being allowed, potentially compromising rate limiting efforts. Users are advised to update to version 8.7.2 or later to mitigate this issue.

References