{
  "affected": [
    {
      "affectedData": [
        {
          "product": "express-rate-limit",
          "vendor": "express-rate-limit",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.0.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.1.0, \u003c 8.1.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.2.0, \u003c 8.2.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:express-rate-limit_project:express-rate-limit:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AE5ED6AB-D445-4E61-86B1-FBC0659382A0",
              "versionEndExcluding": "8.0.2",
              "versionStartIncluding": "8.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:express-rate-limit_project:express-rate-limit:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F501D9EB-DFE4-496D-8471-61DE755B9E05",
              "versionEndExcluding": "8.2.2",
              "versionStartIncluding": "8.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:express-rate-limit_project:express-rate-limit:8.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C56713D6-533F-424A-B511-5E63014709D8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "express-rate-limit is a basic rate-limiting middleware for Express. In versions starting from 8.0.0 and prior to versions 8.0.2, 8.1.1, 8.2.2, and 8.3.0, the default keyGenerator in express-rate-limit applies IPv6 subnet masking (/56 by default) to all addresses that net.isIPv6() returns true for. This includes IPv4-mapped IPv6 addresses (::ffff:x.x.x.x), which Node.js returns as request.ip on dual-stack servers. Because the first 80 bits of all IPv4-mapped addresses are zero, a /56 (or any /32 to /80) subnet mask produces the same network key (::/56) for every IPv4 client. This collapses all IPv4 traffic into a single rate-limit bucket: one client exhausting the limit causes HTTP 429 for all other IPv4 clients. This issue has been patched in versions 8.0.2, 8.1.1, 8.2.2, and 8.3.0."
    },
    {
      "lang": "es",
      "value": "express-rate-limit es un middleware b\u00e1sico de limitaci\u00f3n de tasa para Express. En versiones a partir de la 8.0.0 y anteriores a las versiones 8.0.2, 8.1.1, 8.2.2 y 8.3.0, el keyGenerator predeterminado en express-rate-limit aplica enmascaramiento de subred IPv6 (/56 por defecto) a todas las direcciones para las que net.isIPv6() devuelve verdadero. Esto incluye direcciones IPv6 mapeadas a IPv4 (::ffff:x.x.x.x), que Node.js devuelve como request.ip en servidores de doble pila. Debido a que los primeros 80 bits de todas las direcciones mapeadas a IPv4 son cero, una m\u00e1scara de subred /56 (o cualquier /32 a /80) produce la misma clave de red (::/56) para cada cliente IPv4. Esto colapsa todo el tr\u00e1fico IPv4 en un \u00fanico cubo de limitaci\u00f3n de tasa: un cliente que agota el l\u00edmite causa HTTP 429 para todos los dem\u00e1s clientes IPv4. Este problema ha sido parcheado en las versiones 8.0.2, 8.1.1, 8.2.2 y 8.3.0."
    }
  ],
  "id": "CVE-2026-30827",
  "lastModified": "2026-06-17T10:32:59.050",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-30827",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-03-09T20:40:59.712815Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-03-07T06:16:10.507",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/express-rate-limit/express-rate-limit/commit/14e53888cdfd1b9798faf5b634c4206409e27fc4"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/express-rate-limit/express-rate-limit/security/advisories/GHSA-46wh-pxpv-q5gq"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}