CVE-2026-15144 @fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation

@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range a /64 holds 2^64 distinct addresses and the same address has multiple valid textual representations, an IPv6 capable...

@a11ywatch/a11ywatch (>=0.1.66, <=0.3.82), @a11ywatch/core (>=0.5.0, <=0.8.17) +489 more potentially affected by CVE-2026-15144 via @fastify/rate-limit (>=6.0.1, <=11.1.0)

@fastify/rate-limit NPM version =6.0.1, =0.1.66, =0.5.0, =1.0.0, =0.1.1, =0.1.1, =1.0.0, =2.0.0, =3.0.0, =0.2.0, =0.1.1, =1.6.2, =1.0.3, =0.3.3, =0.2.0, =0.5.3 and more Source cves: CVE-2026-15144 Source advisory: MEND:CVE-2026-15144...

CVE-2026-15144: Improper Restriction of Excessive Authentication Attempts

@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range a /64 holds 2^64 distinct addresses and the same address has multiple valid textual representations, an IPv6 capable...