# CVE-2026-15144: Fastify @fastify/rate-limit rate-limit bypass via IPv6 address rotation

Source: https://junglewise.ai/threats/cve-2026-15144-fastify-fastify-rate-limit-rate-limit-bypass-via-ipv6-address  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-15144 · Severity: high · CVSS 7.3 · Published 2026-07-29

A vulnerability in the Fastify rate-limiting library allows attackers to bypass request limits by using different IPv6 addresses or formatting the same address in various ways. This component is typically used to protect sensitive operations like login attempts, password resets, and expensive API calls from abuse. An attacker can exploit this to perform brute-force attacks or overwhelm services, potentially leading to account takeovers or service degradation.

Vendors: [Fastify](https://junglewise.ai/threats/vendors/fastify).

## Quick answers

**Is CVE-2026-15144 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15144 being exploited in the wild.

**How severe is CVE-2026-15144?** High severity, with a CVSS score of 7.3, published 29 July 2026.

**Which products and versions are affected?** Fastify Rate-Limit < 11.2.0.

**Is there a fix for CVE-2026-15144?** A patch was published on 2026-07-29: Fixed in version 11.2.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-15144 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15144?** Check whether you run Fastify Rate-Limit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The @fastify/rate-limit library before version 11.2.0 keys rate-limit buckets using the verbatim client IP string from request.ip. Because IPv6 allows for multiple valid textual representations of the same address and provides users with large address blocks (typically a /64), attackers can bypass limits by rotating through addresses or using non-canonical string formats. This is particularly effective when the application is behind a proxy that surfaces IPv6 to the origin and has trustProxy enabled. The vulnerability is addressed in version 11.2.0 by introducing a default key generator that normalizes IPv6 addresses to their canonical form and applies a configurable prefix mask (default /64) via the new ipv6Subnet option.

## Affected products

- Fastify @fastify/rate-limit < 11.2.0

## Timeline

- 2026-07-29: disclosed
- 2026-07-29: advisory
- 2026-07-29: patched: Fixed in version 11.2.0

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/fastify/fastify-rate-limit/security/advisories/GHSA-grpc-p53c-r64v](https://github.com/fastify/fastify-rate-limit/security/advisories/GHSA-grpc-p53c-r64v)