CVE-2026-15144

@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range (a /64 holds 2^64 distinct addresses) and the same address has multiple valid textual representations, an IPv6 capable client can defeat the rate-limit boundary by rotating addresses or by rewriting the same address in different forms. Applications that use @fastify/rate-limit to protect endpoints such as authentication, password reset, OTP delivery, or expensive API calls can be bypassed by IPv6 clients behind a proxy that surfaces IPv6 to the origin when trustProxy is enabled. The issue is fixed in @fastify/rate-limit 11.2.0, where the default key generator normalizes IPv6 addresses to their canonical form, collapses IPv4 mapped IPv6 to IPv4, and applies a configurable prefix mask (default /64) via a new ipv6Subnet option.

• CWE-307
• CWE-770

• https://cna.openjsf.org/security-advisories.htmlVendor Advisory
• https://github.com/fastify/fastify-rate-limit/security/advisories/GHSA-grpc-p53c-r64vVendor Advisory

Published

Jul 29, 2026

Last Modified

Aug 5, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-15135A security flaw has been discovered in code-projects Online …7.3
• CVE-2026-15136The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plug…4.3
• CVE-2026-15137A weakness has been identified in code-projects Interview Ma…7.3
• CVE-2026-15138A security vulnerability has been detected in tumf mcp-text-…6.3
• CVE-2026-1514Official Document Management System developed by 2100 Techno…7.1
• CVE-2026-15143A flaw was found in the file_type content detector of guardr…9.3
• CVE-2026-15145The Essential Addons for Elementor – Popular Elementor Templ…6.4
• CVE-2026-15146GNU Wget does not validate the IP address provided by an FTP…5.9
• CVE-2026-15147The Five Star Restaurant Reservations WordPress plugin befor…5.3
• CVE-2026-15148The WP Events Manager WordPress plugin before 2.2.5 does not…5.3
• CVE-2026-15149The WP Hotel Booking WordPress plugin before 2.3.3 does not …5.3
• CVE-2026-15151The Five Star Restaurant Reservations WordPress plugin befo…7.5