CVE-2026-30827 affects express-rate-limit versions 8.0.0 through 8.0.1, 8.1.0, 8.2.0, and 8.2.1. The vulnerability stems from the default keyGenerator incorrectly applying IPv6 subnet masking to IPv4-mapped IPv6 addresses, causing all IPv4 traffic to be grouped into a single rate-limit bucket on dual-stack servers. This allows a single IPv4 client to exhaust the rate limit, leading to a Denial of Service (DoS) for all other IPv4 clients. The vulnerability has a CVSS score of 7.5 (High), indicating a network-based attack with low complexity and high impact on availability. There is no authentication required, and no user interaction is needed for exploitation. There is no evidence of active exploitation, nor are there known Metasploit, Nuclei, or ExploitDB modules available. Community discussion is minimal, with only one mention identified. Patches are available in versions 8.0.2, 8.1.1, 8.2.2, and 8.3.0.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 8.0.0, < 8.0.2CPE matchmatch criteria | cpe:2.3:a:express-rate-limit_project:express-rate-limit:*:*:*:*:*:*:*:* | ||
>= 8.2.0, < 8.2.2CPE matchmatch criteria | cpe:2.3:a:express-rate-limit_project:express-rate-limit:*:*:*:*:*:*:*:* | ||
8.1.0CPE matchmatch criteria | cpe:2.3:a:express-rate-limit_project:express-rate-limit:8.1.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.