An incorrect subnet masking implementation in express-rate-limit allows unauthenticated attackers to trigger a denial of service by collapsing all IPv4 traffic into a single rate-limit bucket.

The library incorrectly applies IPv6 subnet masking to IPv4-mapped IPv6 addresses, causing all IPv4 traffic to be treated as a single source. This is an unauthenticated resource exhaustion vulnerability that allows any user to trigger HTTP 429 status codes for all other legitimate IPv4 clients.

Successful exploitation of this flaw results in a denial of service for all users connecting via IPv4, as their traffic is erroneously aggregated into a single rate-limit bucket. This causes significant service availability issues, impacting legitimate customer access and overall system reliability. With a CVSS score of 7.5, the high impact on service availability necessitates urgent attention, particularly for public-facing web applications.

Immediate Action: Update the express-rate-limit package to version 8.0.2, 8.1.1, 8.2.2, or 8.3.0 to resolve the subnet masking logic error.

Proactive Monitoring: Review web server access logs for anomalous spikes in HTTP 429 responses, which may indicate that the rate-limiting middleware is incorrectly blocking legitimate traffic.

Compensating Controls: If immediate patching is not feasible, consider implementing rate limiting at the infrastructure level, such as via an Nginx ingress controller or a cloud-based Web Application Firewall, to bypass the vulnerable middleware logic.

Public Exploit Available: Unknown

The vulnerability presents a clear risk to service availability by allowing a single client to unintentionally or maliciously exhaust the rate-limit quota for all other IPv4 users. Organizations relying on this middleware should prioritize updating to the specified patched versions to restore granular rate-limiting functionality and prevent widespread service denial.