CVE-2026-15144

Analyzed Analyzed - Analysis Complete

Rate Limit Bypass via IPv6 Address Manipulation in Fastify Rate Limit

Publication date: 2026-07-29

Last updated on: 2026-08-05

Assigner: openjs

Description

@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range (a /64 holds 2^64 distinct addresses) and the same address has multiple valid textual representations, an IPv6 capable client can defeat the rate-limit boundary by rotating addresses or by rewriting the same address in different forms. Applications that use @fastify/rate-limit to protect endpoints such as authentication, password reset, OTP delivery, or expensive API calls can be bypassed by IPv6 clients behind a proxy that surfaces IPv6 to the origin when trustProxy is enabled. The issue is fixed in @fastify/rate-limit 11.2.0, where the default key generator normalizes IPv6 addresses to their canonical form, collapses IPv4 mapped IPv6 to IPv4, and applies a configurable prefix mask (default /64) via a new ipv6Subnet option.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-05

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-15144

Affected Vendors & Products

Vendor	Product	Version / Range
fastify	fastify/rate-limit	to 11.2.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-307	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability affects the @fastify/rate-limit package before version 11.2.0. It allows IPv6 clients to bypass rate limits by exploiting multiple valid textual representations of the same IPv6 address or by rotating through a large address range within a /64 subnet. The package keys rate-limit buckets using the raw client IP string from request.ip, which can be manipulated by IPv6 clients.

Detection Guidance

To detect this vulnerability, check if your system uses @fastify/rate-limit versions before 11.2.0. Run: npm list @fastify/rate-limit. If the version is below 11.2.0, the system is vulnerable. Inspect network logs for repeated requests from IPv6 clients that may be bypassing rate limits.

Impact Analysis

If you use @fastify/rate-limit to protect sensitive endpoints like authentication or password reset, attackers can bypass rate limits by cycling through different IPv6 address representations. This could lead to brute-force attacks, increased server load, or unauthorized access to protected resources.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access or excessive requests to protected endpoints such as authentication or password reset systems. If rate-limiting is bypassed, it may lead to brute force attacks or denial of service, compromising data confidentiality and integrity.

Mitigation Strategies

Upgrade @fastify/rate-limit to version 11.2.0 or later. If upgrading is not possible, configure the ipv6Subnet option to apply a prefix mask (default /64) and normalize IPv6 addresses. Disable trustProxy if not required to prevent client IP manipulation.

Hi! I’m here to help you understand CVE-2026-15144. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70