Executive brief
A vulnerability in the Fastify rate-limiting library allows attackers to bypass request limits by using different IPv6 addresses or formatting the same address in various ways. This component is typically used to protect sensitive operations like login attempts, password resets, and expensive API calls from abuse. An attacker can exploit this to perform brute-force attacks or overwhelm services, potentially leading to account takeovers or service degradation.
Technical details
The @fastify/rate-limit library before version 11.2.0 keys rate-limit buckets using the verbatim client IP string from request.ip. Because IPv6 allows for multiple valid textual representations of the same address and provides users with large address blocks (typically a /64), attackers can bypass limits by rotating through addresses or using non-canonical string formats. This is particularly effective when the application is behind a proxy that surfaces IPv6 to the origin and has trustProxy enabled. The vulnerability is addressed in version 11.2.0 by introducing a default key generator that normalizes IPv6 addresses to their canonical form and applies a configurable prefix mask (default /64) via the new ipv6Subnet option.
Affected products
- Fastify @fastify/rate-limit < 11.2.0
Timeline
- 2026-07-29: disclosed
- 2026-07-29: advisory
- 2026-07-29: patched: Fixed in version 11.2.0