{"id":"EUVD-2026-10113","revision":"2ae279ffa7f74decafa1d8ea73f0bf4b","records":[{"revision":"2ae279ffa7f74decafa1d8ea73f0bf4b","observedAt":"2026-11-09T07:15:10.614+00:00","statement":{"source":"euvd","id":"EUVD-2026-10113","aliases":["CVE-2026-30827","GHSA-46wh-pxpv-q5gq"],"title":"express-rate-limit is a basic rate-limiting middleware for Express. In versions starting from 8.0.0 and prior to versions 8.0.2, 8.1.1, 8.2.2, and 8.3.0, the default keyGenerator in express-rate-limit applies IPv6 subnet masking (/56 by def…","description":"express-rate-limit is a basic rate-limiting middleware for Express. In versions starting from 8.0.0 and prior to versions 8.0.2, 8.1.1, 8.2.2, and 8.3.0, the default keyGenerator in express-rate-limit applies IPv6 subnet masking (/56 by default) to all addresses that net.isIPv6() returns true for. This includes IPv4-mapped IPv6 addresses (::ffff:x.x.x.x), which Node.js returns as request.ip on dual-stack servers. Because the first 80 bits of all IPv4-mapped addresses are zero, a /56 (or any /32 to /80) subnet mask produces the same network key (::/56) for every IPv4 client. This collapses all IPv4 traffic into a single rate-limit bucket: one client exhausting the limit causes HTTP 429 for all other IPv4 clients. This issue has been patched in versions 8.0.2, 8.1.1, 8.2.2, and 8.3.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/express-rate-limit/express-rate-limit/security/advisories/GHSA-46wh-pxpv-q5gq","https://github.com/express-rate-limit/express-rate-limit/commit/14e53888cdfd1b9798faf5b634c4206409e27fc4"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-10113","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Mar 7, 2026, 5:19:08 AM","dateUpdated":"Mar 9, 2026, 8:44:25 PM"},"relatedAdvisories":[{"id":"RHSA-2026:6404","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update","vulnerabilityIds":["CVE-2025-69223","CVE-2025-69873","CVE-2026-1615","CVE-2026-25639","CVE-2026-25990","CVE-2026-26007","CVE-2026-28498","CVE-2026-28802","CVE-2026-29074","CVE-2026-30827","CVE-2026-30922"]},{"id":"RHSA-2026:6309","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update","vulnerabilityIds":["CVE-2025-69223","CVE-2025-69873","CVE-2026-1615","CVE-2026-25639","CVE-2026-25990","CVE-2026-26007","CVE-2026-28498","CVE-2026-28802","CVE-2026-29074","CVE-2026-30827","CVE-2026-30922"]},{"id":"RHSA-2026:21772","title":"Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.28.0 Release.","vulnerabilityIds":["CVE-2025-14813","CVE-2025-68121","CVE-2026-0636","CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-1605","CVE-2026-2229","CVE-2026-2327","CVE-2026-5588","CVE-2026-26996","CVE-2026-27904","CVE-2026-29074","CVE-2026-30827","CVE-2026-31802","CVE-2026-32141","CVE-2026-32280","CVE-2026-32282","CVE-2026-32305","CVE-2026-33252","CVE-2026-33810","CVE-2026-34742","CVE-2026-35051","CVE-2026-39858","CVE-2026-40477","CVE-2026-40478","CVE-2026-40611","CVE-2026-40895","CVE-2026-40912","CVE-2026-40972","CVE-2026-40973","CVE-2026-40975","CVE-2026-41240","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"WID-SEC-W-2026-0935","title":"Red Hat Ansible Automation Platform: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2025-69223","CVE-2025-69873","CVE-2026-25639","CVE-2026-25990","CVE-2026-29074","CVE-2026-30827","CVE-2026-30922","CVE-2026-26007","CVE-2026-1615","CVE-2026-28498","CVE-2026-28802"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-10113","identifiers":["EUVD-2026-10113","CVE-2026-30827","GHSA-46wh-pxpv-q5gq"]},"retained":false,"historicalAffected":[]}],"coverage":[]}