EUVD-2026-50402Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain routable IPv6 /64 range
-
DeliveryTarget auth/OTP endpoint behind plugin
-
ExploitRotate source IPv6 per request
-
ExecutionEach address keyed as new bucket
-
PersistRate limit never enforced
-
ImpactBrute-force credentials or abuse endpoint
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Brute-force prevention, rate limiting
|
| Exploitation Conditions | Exploitation requires the target Fastify app to use @fastify/rate-limit (before 11.2.0) with its default IP-based key generator, to have trustProxy enabled, and to have IPv6 client addresses surfaced to the origin (e.g. via a proxy passing X-Forwarded-For or a dual-stack listener). The attacker must control an IPv6 range (a /64 suffices) or be able to send re-encoded forms of a single IPv6 address. Limiting factors: IPv4-only deployments and setups where the proxy collapses clients to a single upstream IP are not exploitable; no authentication or user interaction is needed once these conditions hold. This is not a default-configuration remote flaw - it hinges on the trustProxy + IPv6 deployment mode. |
| Impact | The published CVSS is 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), reflecting network reachability with no privileges. However, the description imposes a real precondition - trustProxy must be enabled and IPv6 must be surfaced to the origin - which is not universal, so effective attack complexity is higher than AC:L implies. No EPSS score, KEV listing, or POC was provided; there is no public exploit identified at time of analysis and no evidence of active exploitation, so this is not an emergency same-day patch for most operators. The genuine risk is indirect: the flaw does not itself compromise data but removes a control, amplifying downstream threats (credential stuffing, OTP brute force, cost/DoS on expensive endpoints). Priority should scale to whether the deployment actually terminates IPv6 with trustProxy on and relies on this plugin as its primary throttle; IPv4-only stacks are effectively unaffected. |
| Exploit ScenarioDerived | An attacker with a routed IPv6 /64 (trivial from many hosting providers) targets a login or OTP endpoint fronted by @fastify/rate-limit with trustProxy enabled. They script a brute-force loop that assigns a fresh source address (or a re-encoded form of the same address) to each request, so every attempt lands in a new rate-limit bucket and the throttle never trips. No POC was provided, but the technique requires only routine tooling given the low attack complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 29, 2026
Rate-limit bypass in @fastify/rate-limit before 11.2.0 lets IPv6-capable clients defeat request throttling by rotating source addresses across a controlled /64 range or by re-encoding the same address in different textual forms, because buckets are keyed on the verbatim request.ip string. Applications relying on this plugin to protect authentication, password-reset, OTP, or expensive API endpoints can be brute-forced or abused when trustProxy is enabled and IPv6 reaches the origin. No public exploit identified at time of analysis; the flaw is fixed in 11.2.0 via IPv6 canonicalization and a default /64 prefix mask.
RemediationAI
Vendor-released patch: 11.2.0 - upgrade @fastify/rate-limit to 11.2.0 or later, where the default key generator normalizes IPv6 to canonical form, collapses IPv4-mapped IPv6 to IPv4, and masks to a configurable prefix (default /64) via the ipv6Subnet option; tune ipv6Subnet if clients legitimately span multiple /64s or if you need a tighter boundary. If you cannot upgrade immediately, supply a custom keyGenerator that canonicalizes and prefix-masks the client IP, or disable trustProxy so untrusted client IPv6 addresses are not honored (trade-off: real client IPs may be masked behind the proxy, reducing per-client accuracy). As defense in depth for auth flows, add account-level or credential-level lockout and CAPTCHA that do not depend on IP keying. See the advisory at https://github.com/fastify/fastify-rate-limit/security/advisories/GHSA-grpc-p53c-r64v.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
@fastify/rate-limit is a plugin for the Fastify Node.js web framework that enforces per-client request quotas, commonly placed in front of authentication and abuse-prone routes. The root cause maps to CWE-307 (Improper Restriction of Excessive Authentication Attempts): the default key generator used request.ip as an opaque string without normalization. IPv6 breaks the implicit one-client-one-key assumption - a single subscriber is typically delegated an entire /64 (2^64 addresses), and IPv6 has many equivalent textual representations (compressed vs. expanded zeros, IPv4-mapped forms like ::ffff:1.2.3.4). Counting each literal string as a distinct client maps one actor to effectively unlimited buckets. The fix in 11.2.0 canonicalizes IPv6 addresses, collapses IPv4-mapped IPv6 to IPv4, and applies a configurable prefix mask (default /64) through a new ipv6Subnet option so an entire subnet shares one bucket.
Know when Fastify Rate Limit gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Non-default trustProxy+IPv6 path raises AC:H; no privileges needed; impact is bypass of the throttling control (I:L) and resource/cost abuse (A:L), with no direct confidentiality loss.
Primary rating from Vendor (openjs).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range (a /64 holds 2^64 distinct addresses) and the same address has multiple valid textual representations, an IPv6 capable client can defeat the rate-limit boundary by rotating addresses or by rewriting the same address in different forms. Applications that use @fastify/rate-limit to protect endpoints such as authentication, password reset, OTP delivery, or expensive API calls can be bypassed by IPv6 clients behind a proxy that surfaces IPv6 to the origin when trustProxy is enabled. The issue is fixed in @fastify/rate-limit 11.2.0, where the default key generator normalizes IPv6 addresses to their canonical form, collapses IPv4 mapped IPv6 to IPv4, and applies a configurable prefix mask (default /64) via a new ipv6Subnet option.
Executive ViewAI
@fastify/rate-limit before 11.2.0 contains a rate-limit bypass allowing IPv6-capable clients to circumvent authentication brute-force protections, enabling credential attacks on login, password-reset, and OTP endpoints. Organizations using the plugin with trustProxy enabled face immediate risk of account compromise.
Apply vendor patch: 11.2.0
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB