CVE-2026-15144 @fastify/rate-limit CVE debrief

Who should care

Developers and administrators using @fastify/rate-limit in their applications, especially those protecting sensitive endpoints like authentication or API calls, should prioritize upgrading to version 11.2.0 or later. Additionally, security teams and vulnerability management teams should review the affected scope and severity of this vulnerability and plan for mitigation or remediation accordingly. Platform operators and administrators should also review the impacted systems and prioritize patching or mitigation efforts. Security teams should monitor for potential rate-limit bypass attempts and review compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory and change management teams should also be involved in tracking exceptions and retesting remediated assets. Source tracking and logging teams should review relevant monitoring, detection, and logs for exposed assets that need extra review. IT and security management should ensure that proper change control processes are followed for updates and mitigations. Lastly, incident response teams should be prepared to handle potential exploitation attempts and have a plan in place for rapid response and remediation if needed. The CVE record was published on 2026-07-29T17:16:50.637Z and has not been modified since then. The NVD entry is currently Analyzed. The issue is fixed in @fastify/rate-limit 11.2.0, where the default key generator normalizes IPv6 addresses to their canonical form, collapses IPv4 mapped IPv6 to IPv4, and applies a configurable prefix mask (default /64) via a new ipv6Subnet option. Applications that use @fastify/rate-limit to protect endpoints such as authentication, password reset, OTP delivery, or expensive API calls can be bypassed by IPv6 clients behind a proxy that surfaces IPv6 to the origin when trustProxy is enabled. Because a single IPv6 client can control a large address range (a /64 holds 2^64 distinct addresses) and the same address has multiple valid textual representations, an IPv6 capable client can defeat the rate-limit boundary by rotating addresses or by rewriting the same address in different forms. The @fastify/rate-limit package is

Technical summary

The @fastify/rate-limit package before version 11.2.0 is vulnerable to rate-limit bypass by IPv6 clients. The package uses the verbatim client IP string for rate-limit buckets, allowing IPv6 clients to rotate addresses or rewrite them to bypass limits. This issue can affect applications protecting endpoints like authentication or expensive API calls. The vulnerability is fixed in version 11.2.0, which normalizes IPv6 addresses and applies a configurable prefix mask. Organizations using @fastify/rate-limit before version 11.2.0 should prioritize upgrading to mitigate potential rate-limit bypass by IPv6 clients.

Defensive priority

Organizations using @fastify/rate-limit before version 11.2.0 should prioritize upgrading to mitigate potential rate-limit bypass by IPv6 clients.

Recommended defensive actions

• Upgrade @fastify/rate-limit to version 11.2.0 or later
• Review and adjust IPv6 address handling in your application
• Monitor for potential rate-limit bypass attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE-2026-15144 issue arises from @fastify/rate-limit's use of verbatim client IP strings for rate-limit buckets. IPv6 clients can bypass rate limits by rotating addresses or rewriting them due to multiple valid textual representations. The issue is fixed in version 11.2.0, which normalizes IPv6 addresses and applies a configurable prefix mask.

Official resources