EUVD-2026-50402Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Non-default trustProxy+IPv6 path raises AC:H; no privileges needed; impact is bypass of the throttling control (I:L) and resource/cost abuse (A:L), with no direct confidentiality loss.
Primary rating from Vendor (openjs).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range (a /64 holds 2^64 distinct addresses) and the same address has multiple valid textual representations, an IPv6 capable client can defeat the rate-limit boundary by rotating addresses or by rewriting the same address in different forms. Applications that use @fastify/rate-limit to protect endpoints such as authentication, password reset, OTP delivery, or expensive API calls can be bypassed by IPv6 clients behind a proxy that surfaces IPv6 to the origin when trustProxy is enabled. The issue is fixed in @fastify/rate-limit 11.2.0, where the default key generator normalizes IPv6 addresses to their canonical form, collapses IPv4 mapped IPv6 to IPv4, and applies a configurable prefix mask (default /64) via a new ipv6Subnet option.
AnalysisAI
Rate-limit bypass in @fastify/rate-limit before 11.2.0 lets IPv6-capable clients defeat request throttling by rotating source addresses across a controlled /64 range or by re-encoding the same address in different textual forms, because buckets are keyed on the verbatim request.ip string. Applications relying on this plugin to protect authentication, password-reset, OTP, or expensive API endpoints can be brute-forced or abused when trustProxy is enabled and IPv6 reaches the origin. No public exploit identified at time of analysis; the flaw is fixed in 11.2.0 via IPv6 canonicalization and a default /64 prefix mask.
Technical ContextAI
@fastify/rate-limit is a plugin for the Fastify Node.js web framework that enforces per-client request quotas, commonly placed in front of authentication and abuse-prone routes. The root cause maps to CWE-307 (Improper Restriction of Excessive Authentication Attempts): the default key generator used request.ip as an opaque string without normalization. IPv6 breaks the implicit one-client-one-key assumption - a single subscriber is typically delegated an entire /64 (2^64 addresses), and IPv6 has many equivalent textual representations (compressed vs. expanded zeros, IPv4-mapped forms like ::ffff:1.2.3.4). Counting each literal string as a distinct client maps one actor to effectively unlimited buckets. The fix in 11.2.0 canonicalizes IPv6 addresses, collapses IPv4-mapped IPv6 to IPv4, and applies a configurable prefix mask (default /64) through a new ipv6Subnet option so an entire subnet shares one bucket.
RemediationAI
Vendor-released patch: 11.2.0 - upgrade @fastify/rate-limit to 11.2.0 or later, where the default key generator normalizes IPv6 to canonical form, collapses IPv4-mapped IPv6 to IPv4, and masks to a configurable prefix (default /64) via the ipv6Subnet option; tune ipv6Subnet if clients legitimately span multiple /64s or if you need a tighter boundary. If you cannot upgrade immediately, supply a custom keyGenerator that canonicalizes and prefix-masks the client IP, or disable trustProxy so untrusted client IPv6 addresses are not honored (trade-off: real client IPs may be masked behind the proxy, reducing per-client accuracy). As defense in depth for auth flows, add account-level or credential-level lockout and CAPTCHA that do not depend on IP keying. See the advisory at https://github.com/fastify/fastify-rate-limit/security/advisories/GHSA-grpc-p53c-r64v.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today