CVE-2026-15144
Description
A flaw was found in @fastify/rate-limit. This vulnerability allows a remote attacker to bypass rate-limiting protections by manipulating IPv6 addresses. By rotating or reformatting their IP address, an attacker can circumvent security measures on sensitive endpoints, such as those for authentication or password resets. This could lead to brute-force attacks, potentially resulting in unauthorized access or denial of service (DoS) by exhausting system resources.
Statement
This vulnerability is rated as having Important impact because unauthenticated remote attackers can evade request throttling mechanisms on exposed network services, enabling automated brute-force attacks or resource depletion against critical workflows. In Red Hat environments, the exposure occurs in applications relying on the Fastify rate-limiting plugin where IPv6 traffic is accepted directly or forwarded via trusted reverse proxies. Because each client can leverage multiple IP representations or cycle through broad subnet allocations, rate limits keyed on literal IP values fail to constrain malicious traffic. Consequently, protections safeguarding credential verification, token generation, and other sensitive API endpoints can be rendered ineffective.
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context; Bypass Protection Mechanism
Attackers can sometimes bypass input validation schemes by finding inputs that appear to be safe, but will be dangerous when processed at a lower layer or by a downstream component. For example, a simple XSS protection mechanism might try to validate that an input has no "<script>" tags using case-sensitive matching (CWE-178), but since HTML is case-insensitive when processed by web browsers, an attacker could inject "<ScrIpT>" and trigger XSS (CWE-79).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
