CVE-2026-15144 @fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation
Attackers can bypass rate limits in Fastify applications by rotating IPv6 addresses, exposing protected endpoints to abuse.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15144?
CVE-2026-15144 is a high-severity vulnerability in @fastify/rate-limit, published on 29 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range (a /64 holds 2^64 distinct addresses) and the same address has multiple valid textual representations, an IPv6 capable client can defeat the rate-limit boundary by rotating addresses or by rewriting the same address in different forms. Applications that use @fastify/rate-limit to protect endpoints such as authentication, password reset, OTP delivery, or expensive API calls can be bypassed by IPv6 clients behind a proxy that surfaces IPv6 to the origin when trustProxy is enabled. The issue is fixed in @fastify/rate-limit 11.2.0, where the default key generator normalizes IPv6 addresses to their canonical form, collapses IPv4 mapped IPv6 to IPv4, and applies a configurable prefix mask (default /64) via a new ipv6Subnet option.
Which versions are affected by CVE-2026-15144?
It affects 1 product.
Products include Fastify Fastify\/Rate-Limit.
How do I fix CVE-2026-15144?
No fix has been published for CVE-2026-15144 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-15144 being exploited?
There is no known exploitation of CVE-2026-15144 in the wild and no public exploit code.
Sources
Also known as GHSA-grpc-p53c-r64v.