Rate Limiting Flaw in Express Middleware Affecting Multiple Versions
CVE-2026-30827
What is CVE-2026-30827?
The express-rate-limit middleware for Express contains a flaw in its key generation mechanism affecting versions from 8.0.0 up to, but not including, 8.0.2, 8.1.1, 8.2.2, and 8.3.0. This vulnerability incorrectly applies /56 subnet masking to all IPv6 addresses detected by net.isIPv6(), including IPv4-mapped IPv6 addresses. This results in a serious issue where all IPv4 traffic is consolidated into a single rate-limiting bucket. Consequently, if one IPv4 client exceeds its rate limit, all IPv4 clients experience HTTP 429 responses, significantly hampering accessibility and functionality. The issue can severely disrupt services where multiple users rely on the same IPv4 address, prompting urgent action for mitigation.
Affected Version(s)
express-rate-limit >= 8.0.0, < 8.0.2 < 8.0.0, 8.0.2
express-rate-limit >= 8.1.0, < 8.1.1 < 8.1.0, 8.1.1
express-rate-limit >= 8.2.0, < 8.2.2 < 8.2.0, 8.2.2