@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a …

CVE-2026-15144 affects @fastify/rate-limit versions before 11.2.0, where rate-limit buckets are keyed by the verbatim client IP string from request.ip. IPv6 clients can exploit this by rotating through a large address range (a /64 subnet contains 2^64 addresses) or by representing the same address in multiple valid textual forms, effectively bypassing rate-limiting controls. This vulnerability is particularly dangerous for endpoints protecting authentication, password reset, OTP delivery, and expensive API calls. The attack is amplified when trustProxy is enabled, as proxies may surface IPv6 addresses directly to the origin. The fix in version 11.2.0 normalizes IPv6 addresses to canonical form, collapses IPv4-mapped IPv6 addresses to IPv4, and introduces a configurable prefix mask (default /64) via a new ipv6Subnet option. Organizations using @fastify/rate-limit for security-sensitive rate limiting should upgrade immediately to version 11.2.0 or later.