CVE-2026-30827 express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network
Attackers can exhaust a shared rate-limit bucket for all IPv4 clients on dual-stack servers, causing denial of service for legitimate users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-30827?
CVE-2026-30827 is a high-severity denial of service vulnerability in express-rate-limit, published on 7 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
express-rate-limit is a basic rate-limiting middleware for Express. In versions starting from 8.0.0 and prior to versions 8.0.2, 8.1.1, 8.2.2, and 8.3.0, the default keyGenerator in express-rate-limit applies IPv6 subnet masking (/56 by default) to all addresses that net.isIPv6() returns true for. This includes IPv4-mapped IPv6 addresses (::ffff:x.x.x.x), which Node.js returns as request.ip on dual-stack servers. Because the first 80 bits of all IPv4-mapped addresses are zero, a /56 (or any /32 to /80) subnet mask produces the same network key (::/56) for every IPv4 client. This collapses all IPv4 traffic into a single rate-limit bucket: one client exhausting the limit causes HTTP 429 for all other IPv4 clients. This issue has been patched in versions 8.0.2, 8.1.1, 8.2.2, and 8.3.0.
Weakness: CWE-770
Which versions are affected by CVE-2026-30827?
6 open source packages ship an affected version, including express-rate-limit. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
express-rate-limit npm | From 8.0.0 | 8.0.2 |
express-rate-limit npm | From 8.0.0 | 8.0.2 |
express-rate-limit npm | From 8.1.0 | 8.1.1 |
express-rate-limit npm | From 8.1.0 | 8.1.1 |
express-rate-limit npm | From 8.2.0 | 8.2.2 |
express-rate-limit npm | From 8.2.0 | 8.2.2 |
Products include Express-Rate-Limit Project Express-Rate-Limit.
How do I fix CVE-2026-30827?
Upgrade express-rate-limit to a fixed version for your release line: 8.0.2, 8.1.1 or 8.2.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-30827 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-30827 exists.
Sources
Also known as CLEANSTART-2026-OE71242, CLEANSTART-2026-WJ43064, GHSA-46wh-pxpv-q5gq, MINI-5pjc-v2m4-r873, MINI-rx46-c4hf-jx64, MINI-x924-rgj7-vhrw.