GHSA-46wh-pxpv-q5gq
High · 7.5CVSS
7.5
EPSS
—
Published
Mar 6, 2026
CISA due date
—
The record
express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | express-rate-limit | 8.0.0 | 8.0.2 |
| npm | express-rate-limit | 8.1.0 | 8.1.1 |
| npm | express-rate-limit | 8.2.0 | 8.2.2 |
| Chainguard | kibana-9.1 | 0 | 9.1.10-r7 |
| Chainguard | kibana-9.1-iamguarded | 0 | 9.1.10-r7 |
| Chainguard | kibana-9.2 | 0 | 9.2.6-r1 |
| Chainguard | kibana-9.2-iamguarded | 0 | 9.2.6-r1 |
| Chainguard | kibana-9.3 | 0 | 9.3.1-r1 |
| Chainguard | kibana-9.3-iamguarded | 0 | 9.3.1-r1 |
| Chainguard | langfuse-3-worker | 0 | 3.163.0-r0 |
| Chainguard | langfuse-fips-3-worker | 0 | 3.162.0-r1 |
| Chainguard | opensearch-dashboards-2 | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips | 0 | 2.19.4-r14 |
| Wolfi | langfuse-3-worker | 0 | 3.163.0-r0 |
| Wolfi | opensearch-dashboards-2 | 0 | 2.19.4-r14 |
Related vulnerabilities
- CVE-2026-30827 express-rate-limit is a basic rate-limiting middleware for Express. Same vulnerability
- GHSA-7rx3-28cr-v5wh Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__… Also affects kibana-9.1
- GHSA-442j-39wm-28r2 Handlebars.js has a Property Access Validation Bypass in container.lookup Also affects kibana-9.1
- CVE-2026-33940 Handlebars provides the power necessary to let users build semantic templates. Also affects kibana-9.1
- CVE-2026-33941 Handlebars provides the power necessary to let users build semantic templates. Also affects kibana-9.1
- CVE-2026-33939 Handlebars provides the power necessary to let users build semantic templates. Also affects kibana-9.1
- CVE-2026-33937 Handlebars provides the power necessary to let users build semantic templates. Also affects kibana-9.1
- CVE-2026-33938 Handlebars provides the power necessary to let users build semantic templates. Also affects kibana-9.1