CVE-2026-30827: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30827 is a Denial of Service vulnerability in express-rate-limit, a rate-limiting middleware for Express.js, caused by improper handling of IPv4-mapped IPv6 addresses in the default keyGenerator. Affecting versions 8.0.0–8.0.1, 8.1.0, and 8.2.0–8.2.1, the flaw causes all IPv4 client traffic on dual-stack servers to collapse into a single rate-limit bucket, enabling one client to trigger HTTP 429 responses for all other IPv4 clients. It was disclosed on March 5, 2026, and published to the NVD on March 7, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Security Advisory).

The root cause (CWE-770: Allocation of Resources Without Limits or Throttling) lies in source/ip-key-generator.ts, where the ipKeyGenerator function passes any address for which net.isIPv6() returns true through IPv6 subnet masking. IPv4-mapped IPv6 addresses (e.g., ::ffff:192.168.1.1) satisfy this check, and because the first 80 bits of all such addresses are zero, applying a /56 (or any /32–/80) subnet mask always produces the network key ::/56 — the same bucket for every IPv4 client. On Linux dual-stack servers listening on ::, Node.js represents all IPv4 client connections as ::ffff:x.x.x.x in request.ip, making this the default behavior with no special configuration required. A public proof-of-concept demonstrating the bucket collision is included in the official security advisory (Security Advisory, Fix Commit).

The sole impact is availability: a single unauthenticated attacker can exhaust the shared rate-limit bucket for all IPv4 clients, causing every subsequent IPv4 request to receive an HTTP 429 (Too Many Requests) response until the window resets. There is no confidentiality or integrity impact. The scope is limited to applications using the default keyGenerator on dual-stack Node.js servers, but the blast radius within those deployments is total — all IPv4 users are affected simultaneously by one malicious client (GitHub Advisory).

A JavaScript proof-of-concept demonstrating the key collision is publicly available in the official security advisory, confirmed as a runnable PoC by Feedly threat intelligence. No in-the-wild exploitation has been observed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.013% (0.027% per GitHub Advisory), placing it in the 8th percentile for near-term exploitation likelihood. No threat actor attribution has been reported (Security Advisory, GitHub Advisory).

1. Identify target: Locate an Express.js application using express-rate-limit v8.0.0–8.2.1 with the default keyGenerator on a dual-stack (IPv4/IPv6) server — common on Linux systems listening on :: (e.g., app.listen(port, '::')). Tools like Shodan or manual fingerprinting can help identify Node.js/Express endpoints.
2. Confirm dual-stack behavior: Send a test request from an IPv4 address and observe that request.ip is represented as ::ffff:x.x.x.x (confirming dual-stack mode and vulnerable key generation).
3. Exhaust the rate limit: Send requests rapidly from any IPv4 address (or a single IPv4 client) until the configured rate limit threshold is reached. Because all IPv4 clients share the ::/56 bucket, the attacker's own requests count against the global IPv4 pool.
4. Trigger DoS for all IPv4 clients: Once the shared bucket is exhausted, all subsequent IPv4 client requests receive HTTP 429 responses for the duration of the rate-limit window, effectively denying service to all legitimate IPv4 users (Security Advisory).

• Network: Sudden spike in HTTP 429 responses affecting all IPv4 clients simultaneously; high-volume requests from a single IPv4 source address to rate-limited endpoints.
• Logs: Express access logs showing a single source IP (or a small set) rapidly consuming requests until the limit is hit, followed by a flood of 429 responses to diverse IPv4 clients; rate-limit key ::/56 appearing in application debug logs if logging is enabled.
• Application Behavior: Legitimate IPv4 users reporting widespread HTTP 429 errors while IPv6-native clients are unaffected; rate-limit counters resetting and immediately being re-exhausted in short windows.

Upgrade express-rate-limit to one of the patched versions: 8.0.2, 8.1.1, 8.2.2, or 8.3.0 (or later). The fix in commit 14e5388 modifies ipKeyGenerator to detect IPv4-mapped IPv6 addresses using address.is4() and extract the underlying IPv4 address, ensuring each IPv4 client gets its own rate-limit bucket. As a workaround for those unable to upgrade immediately, implement a custom keyGenerator that explicitly handles IPv4-mapped addresses (e.g., strip the ::ffff: prefix before keying). IBM products including DevOps Solution Workbench, App Connect Enterprise, API Connect, and watsonx Orchestrate that bundle this dependency should apply their respective vendor patches (Security Advisory, IBM DevOps Advisory, IBM App Connect Advisory).

The vulnerability was reported by researcher TinkAnet and published by maintainer gamemaker1 on March 5, 2026, with a rapid patch turnaround backported across all affected minor versions. The issue was noted on Mastodon by security community accounts shortly after disclosure. IBM issued multiple security bulletins acknowledging the impact on several enterprise products (DevOps Solution Workbench, App Connect Enterprise, API Connect, watsonx Orchestrate), indicating broad downstream awareness (GitHub Advisory, IBM API Connect Advisory).