Cloudanix VulnDB

CVE-2026-30827

High · 7.5

CVSS

7.5

EPSS

0.5%

Published

Mar 7, 2026

CISA due date

—

The record

express-rate-limit is a basic rate-limiting middleware for Express. In versions starting from 8.0.0 and prior to versions 8.0.2, 8.1.1, 8.2.2, and 8.3.0, the default keyGenerator in express-rate-limit applies IPv6 subnet masking (/56 by default) to all addresses that net.isIPv6() returns true for. This includes IPv4-mapped IPv6 addresses (::ffff:x.x.x.x), which Node.js returns as request.ip on dual-stack servers. Because the first 80 bits of all IPv4-mapped addresses are zero, a /56 (or any /32 to /80) subnet mask produces the same network key (::/56) for every IPv4 client. This collapses all IPv4 traffic into a single rate-limit bucket: one client exhausting the limit causes HTTP 429 for all other IPv4 clients. This issue has been patched in versions 8.0.2, 8.1.1, 8.2.2, and 8.3.0.

Affected packages

Ecosystem Package Introduced Fixed
npm express-rate-limit 8.0.0 8.0.2
npm express-rate-limit 8.1.0 8.1.1
npm express-rate-limit 8.2.0 8.2.2
Chainguard kibana-9.1 0 9.1.10-r7
Chainguard kibana-9.1-iamguarded 0 9.1.10-r7
Chainguard kibana-9.2 0 9.2.6-r1
Chainguard kibana-9.2-iamguarded 0 9.2.6-r1
Chainguard kibana-9.3 0 9.3.1-r1
Chainguard kibana-9.3-iamguarded 0 9.3.1-r1
Chainguard langfuse-3-worker 0 3.163.0-r0
Chainguard langfuse-fips-3-worker 0 3.162.0-r1
Chainguard opensearch-dashboards-2 0 2.19.4-r14
Chainguard opensearch-dashboards-2-fips 0 2.19.4-r14
Wolfi langfuse-3-worker 0 3.163.0-r0
Wolfi opensearch-dashboards-2 0 2.19.4-r14

Related vulnerabilities