CVE-2026-15144

creationtimestamp| type| source ---|---|--- 2026-07-29 16:15:54+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mrsd4ilqss2c 2026-07-29 19:43:29+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrsopqnc4r2l...

CVE-2026-15144

The vulnerability CVE-2026-15144 affects @fastify/rate-limit prior to version 11.2.0. It buckets rate-limit keys using the verbatim client IP string from request.ip, allowing an IPv6 client to control a large address range (a /64) and bypass limits by rotating addresses or using different textual...

@a11ywatch/a11ywatch (>=0.1.66, <=0.3.82), @a11ywatch/core (>=0.5.0, <=0.8.17) +489 more potentially affected by CVE-2026-15144 via @fastify/rate-limit (>=6.0.1, <=11.1.0)

@fastify/rate-limit NPM version =6.0.1, =0.1.66, =0.5.0, =1.0.0, =0.1.1, =0.1.1, =1.0.0, =2.0.0, =3.0.0, =0.2.0, =0.1.1, =1.6.2, =1.0.3, =0.3.3, =0.2.0, =0.5.3 and more Source cves: CVE-2026-15144 Source advisory: MEND:CVE-2026-15144...