Executive brief
express-rate-limit is a widely used Node.js middleware that enforces per-client request rate limits for Express web applications. On servers configured for both IPv4 and IPv6 (dual-stack networks, common on Linux), a flaw in how the library identifies client addresses causes all IPv4 traffic to be grouped into a single rate-limit bucket. An attacker can make legitimate requests until the shared limit is exhausted, causing all other IPv4 users to receive "too many requests" errors and effectively disabling service for the entire IPv4 user base.
Technical details
The vulnerability is a logic error in the ipKeyGenerator function (source/ip-key-generator.ts). On dual-stack servers, Node.js represents IPv4 clients as IPv4-mapped IPv6 addresses in the form ::ffff:192.168.1.1. The code uses net.isIPv6() to detect IPv6 addresses and applies /56 subnet masking; however, this function returns true for IPv4-mapped addresses. Because the first 80 bits of all IPv4-mapped addresses are zero, a /56 (or any /32 to /80) subnet mask produces an identical network key (::/56) for every IPv4 client, effectively merging all IPv4 traffic into one rate-limit bucket. The fix, committed in 14e5388, explicitly detects and unwraps IPv4-mapped addresses before subnet masking. Attack requires only network access and affects any dual-stack server using the default keyGenerator; custom key generators are unaffected. Patches are available in v8.0.2, v8.1.1, v8.2.2, and v8.3.0+.
Affected products
- express-rate-limit express-rate-limit 8.0.0 to 8.2.1 (fixed in 8.0.2, 8.1.1, 8.2.2, 8.3.0+)
Timeline
- 2026-03-06: disclosed: GHSA-46wh-pxpv-q5gq published on GitHub Security Advisory
- 2026-03-06: patched: Fix committed as 14e5388 and released in v8.0.2, v8.1.1, v8.2.2, and v8.3.0
- 2026-03-07: other: CVE-2026-30827 assigned and published to NVD