CVE-2026-15144
- Source
- https://cve.org/CVERecord?id=CVE-2026-15144
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15144.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-15144
- Aliases
-
- GHSA-grpc-p53c-r64v
- Published
- 2026-07-29T16:10:24Z
- Modified
- 2026-08-12T03:51:37Z
- Severity
-
- 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
- Summary
- @fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation
- Details
-
@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range (a /64 holds 2^64 distinct addresses) and the same address has multiple valid textual representations, an IPv6 capable client can defeat the rate-limit boundary by rotating addresses or by rewriting the same address in different forms. Applications that use @fastify/rate-limit to protect endpoints such as authentication, password reset, OTP delivery, or expensive API calls can be bypassed by IPv6 clients behind a proxy that surfaces IPv6 to the origin when trustProxy is enabled. The issue is fixed in @fastify/rate-limit 11.2.0, where the default key generator normalizes IPv6 addresses to their canonical form, collapses IPv4 mapped IPv6 to IPv4, and applies a configurable prefix mask (default /64) via a new ipv6Subnet option.
- Database specific
{ "cna_assigner": "openjs", "cwe_ids": [ "CWE-307", "CWE-770" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15144.json" }- References
Affected packages
Git / github.com/fastify/fastify-rate-limit
Affected ranges
- Type
- GIT
- Repo
- https://github.com/fastify/fastify-rate-limit
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:fastify:fastify\\/rate-limit:*:*:*:*:*:node.js:*:*", "extracted_events": [ { "introduced": "0" }, { "fixed": "11.2.0" } ], "source": [ "AFFECTED_FIELD", "CPE_RANGE" ] }