CVE-2026-126204 Security feature bypass in express-rate-limit
Clients can keep requests in flight to gain one extra limit in a new window when skipFailedRequests or skipSuccessfulRequests are used with MemoryStore.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Harmful if only installed
- No
- Needs a specific call
- Yes
- Fix
- None listed
What is CVE-2026-126204?
CVE-2026-126204 is a low-severity security feature bypass vulnerability in express-rate-limit, published on 12 Nov 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
express-rate-limit is a basic rate-limiting middleware for Express. From 8.6.0 until 8.7.2, the built-in MemoryStore returns a Client whose mutable resetTime object is retained by middleware using skipFailedRequests or skipSuccessfulRequests. When a later request resets the client window, MemoryStore.resetClient mutates that same Date, so an earlier request that finishes or disconnects after the reset can pass the stale-window guard and decrement the current window's count. A client able to keep requests in flight across the boundary can obtain a bounded extra burst of up to one additional configured limit in the new window; the behavior does not increase the sustained rate. Stores that return a fresh Date are not affected. This issue is fixed in version 8.7.2.
Weakness: CWE-682
Which versions are affected by CVE-2026-126204?
An affected version is only exploitable if your software calls MemoryStore.resetClient. Many projects that include it are not exposed.
How do I fix CVE-2026-126204?
No fix has been published for CVE-2026-126204 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version, and do not rely on a single control for protection. More about Security feature bypass.
Is CVE-2026-126204 being exploited?
There is no known exploitation of CVE-2026-126204 in the wild and no public exploit code.
Sources
Also known as GHSA-j3cq-92fq-qg5f.