CVE-2026-30827Disclosure(express-rate-limit_project / express-rate-limit)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

express-rate-limit is a basic rate-limiting middleware for Express. In versions starting from 8.0.0 and prior to versions 8.0.2, 8.1.1, 8.2.2, and 8.3.0, the default keyGenerator in express-rate-limit applies IPv6 subnet masking (/56 by default) to all addresses that net.isIPv6() returns true for. This includes IPv4-mapped IPv6 addresses (::ffff:x.x.x.x), which Node.js returns as request.ip on dual-stack servers. Because the first 80 bits of all IPv4-mapped addresses are zero, a /56 (or any /32 to /80) subnet mask produces the same network key (::/56) for every IPv4 client. This collapses all IPv4 traffic into a single rate-limit bucket: one client exhausting the limit causes HTTP 429 for all other IPv4 clients. This issue has been patched in versions 8.0.2, 8.1.1, 8.2.2, and 8.3.0.

express-rate-limit_project CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

https://github.com/express-rate-limit/express-rate-limit/security/advisories/GHSA-46wh-pxpv-q5gq

Weakness type (CWE)

CWE-770

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

express-rate-limit

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-03-07); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

express-rate-limit_project

Products

express-rate-limit

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-07	2	Disclosure2
2026-03-12	1	Disclosure1

Full discourse3 posts

CRAC Learning - Tech@cracbot212d
Disclosure
CVE-2026-30827 (CVSS:7.5, HIGH) is Analyzed. express-rate-limit is a basic rate-limiting middleware for Express. In versions starting from 8.0.0 and prior to version..https://nvd.nist.gov/vuln/detail/CVE-2026-30827 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post reports the discovery of CVE-2026-30827, a HIGH‑severity vulnerability affecting express-rate-limit, specifying CVSS, affected package, and impacted versions.
0000017
172 followersView on X
CVE@CVEnew216d
Disclosure
CVE-2026-30827 express-rate-limit is a basic rate-limiting middleware for Express. In versions starting from 8.0.0 and prior to versions 8.0.2, 8.1.1, 8.2.2, and 8.3.0, the default … https://www.cve.org/CVERecord?id=CVE-2026-30827
Post summary
The text announces a new CVE (CVE-2026-30827) affecting specific releases of express-rate-limit, describing the vulnerable component and affected version ranges.
00000142
56.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds217d
Disclosure
CVE-2026-30827 Rate Limit Bypass in express-rate-limit Middleware for IPv4-Mapped IPv6 Addresses https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-30827
Post summary
The post announces a rate‑limit bypass vulnerability in express‑rate‑limit for IPv4‑mapped IPv6 addresses, offering technical detail but no PoC, exploit, or patch info.
0000052
4.0K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	express-rate-limit_project	express-rate-limit	-	-	-
App	express-rate-limit_project	express-rate-limit	8.1.0	-	-

Explore more

Back to dashboard express-rate-limit_project CVEs express-rate-limit vulnerabilities