CVE-2026-15144

Name of the Vulnerable Software and Affected Versions @fastify/rate-limit versions prior to 11.2.0

Description Rate-limit buckets are keyed using the verbatim client IP string from request.ip. An IPv6-capable client can bypass rate-limit boundaries by rotating addresses within a large address range (such as a /64) or by using different textual representations of the same address. This allows attackers to bypass protections on sensitive endpoints like authentication, password reset, OTP delivery, or expensive API calls, particularly when the application is behind a proxy that surfaces IPv6 to the origin and trustProxy is enabled.

Recommendations Update to version 11.2.0.