Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range (a /64 holds 2^64 distinct addresses) and the same address has multiple valid textual representations, an IPv6 capable client can defeat the rate-limit boundary by rotating addresses or by rewriting the same address in different forms. Applications that use @fastify/rate-limit to protect endpoints such as authentication, password reset, OTP delivery, or expensive API calls can be bypassed by IPv6 clients behind a proxy that surfaces IPv6 to the origin when trustProxy is enabled. The issue is fixed in @fastify/rate-limit 11.2.0, where the default key generator normalizes IPv6 addresses to their canonical form, collapses IPv4 mapped IPv6 to IPv4, and applies a configurable prefix mask (default /64) via a new ipv6Subnet option.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 High-severity security fix in @fastify/rate-limit@11.2.0 just released! Patches CVE-2026-15144: rate-limit bypass via IPv6 address rotation https://github.com/fastify/fastify-rate-limit/security/advisories/GHSA-grpc-p53c-r64v
Post summary
Fastify’s rate‑limit plugin update 11.2.0 includes a patch for CVE‑2026‑15144, fixing a rate‑limit bypass that uses IPv6 rotation.
CVE-2026-15144 @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large … https://www.cve.org/CVERecord?id=CVE-2026-15144
Post summary
Fastify’s rate‑limit library (prior to v11.2.0) uses the raw client IP string for bucket keys, enabling an IPv6 client to manipulate many buckets, creating a potential abuse vector. No PoC, exploit, patch, or active exploitation report is mentioned in the excerpt.
🚨*CVE* CVE-2026-15144 @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large … https://www.cve.org/CVERecord?id=CVE-2026-15144 ----- Traducción: CVE-2026-15144 @fa… http://infoflow.cloud`
Post summary
The tweet discloses technical details of CVE‑2026‑15144, explaining how the fastify rate‑limit plugin’s IP‑based bucket keying can be abused, but it does not mention a PoC, exploit tool, patch, or active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fastify | fastify\/rate-limit | - | node.js | - |