GHSA-46wh-pxpv-q5gq — express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network

Affected: npm: express-rate-limit

## Summary

The default `keyGenerator` in express-rate-limit applies IPv6 subnet masking (`/56` by default) to all addresses that `net.isIPv6()` returns true for. This includes IPv4-mapped IPv6 addresses (`::ffff:x.x.x.x`), which Node.js returns as `request.ip` on dual-stack servers.

Because the first 80 bits of all IPv4-mapped addresses are zero, a `/56` (or any `/32` to `/80`) subnet mask produces the same network key (`::/56`) for **every** IPv4 client. This collapses all IPv4 traffic into a single rate-limit bucket: one client exhausting the limit causes HTTP 429 for all other IPv4 clients.

## Details

### Root Cause

In `source/ip-key-generator.ts`:

```typescript export function ipKeyGenerator(ip: string, ipv6Subnet: number | false = 56) { if (ipv6Subnet && isIPv6(ip)) { return `${new Address6(`${ip}/${ipv6Subnet}`).startAddress().correctForm()}/${ipv6Subnet}` } return ip } ```

`net.isIPv6('::ffff:192.168.1.1')` returns `true`, so IPv4-mapped addresses enter the subnet masking path. With a `/56` prefix, the start address for any `::ffff:x.x.x.x` is `::`, producing the key `::/56`.

### Proof of Concept

```javascript const { isIPv6 } = require('net'); const { Address6 } = require('ip-address');

function ipKeyGenerator(ip, ipv6Subnet = 56) { if (ipv6Subnet && isIPv6(ip)) { return `${new Address6(`${ip}/${ipv6Subnet}`).startAddress().correctForm()}/${ipv6Subnet}`; } return ip; }

console.log(ipKeyGenerator('::ffff:192.168.1.1', 56)); // ::/56 cons…

Most recent entries from all

GHSA-46wh-pxpv-q5gq — express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network