AIKIDO-2026-251554

@fastify/rate-limit is vulnerable to Rate Limiting Bypass

Rate Limiting BypassCVE-2026-15144 Published 2 days ago

High Risk

This Affects:

@fastify/rate-limit

0.0.1 - 11.1.0

Fixed in 11.2.0

Are you affected? Scan for Free

TL;DR

The default key generator in @fastify/rate-limit builds rate-limit buckets from the verbatim client IP string returned by request.ip. Because IPv6 clients control large prefix ranges and a single address has multiple valid textual representations, a client can rotate addresses or rewrite the same address in different forms to land in fresh buckets. This lets IPv6 clients defeat rate limits protecting sensitive endpoints such as authentication, password reset, OTP delivery, or expensive APIs, especially behind proxies that surface IPv6 to the origin with trustProxy enabled. The fix normalizes IPv6 addresses to their canonical form, collapses IPv4-mapped IPv6 to IPv4, and applies a configurable prefix mask before using the value as the rate-limit key.

Who does this affect?

You are affected if you run a version before 11.2.0 with the default key generator and your service receives IPv6 client addresses — most commonly when trustProxy is enabled and a proxy or load balancer (Cloudflare, Vercel, Fly.io, AWS ALB, GCP LB, Render, Railway) surfaces client IPv6 addresses to the origin. Clients reaching your endpoints over IPv6 can then rotate addresses within their /64 prefix, or rewrite the same address in different textual forms, to land in fresh rate-limit buckets and bypass the limit. You are not exposed if you supply a custom keyGenerator that already normalizes the IP, or if your clients only reach the service over IPv4.