The vulnerability resides in @fastify/rate-limit versions prior to 11.2.0 where the rate‑limit bucket key is derived straight from the raw client IP string returned by request.ip. Since an IPv6 client can generate a vast address space and an address has many valid textual representations, a malicious user can change or rewrite the IP string to evade the bucket. This bypass undermines controls on authentication, password reset, OTP or other expensive API calls, effectively allowing an attacker to send unlimited requests or perform brute‑force attacks. The weakness corresponds to CWE‑307 (authorization bypass) and CWE‑770 (excessive resource consumption).

The affected product is the @fastify/rate-limit module, specifically all releases older than 11.2.0. No other vendors or products are listed.

The CVSS score of 7.3 places the vulnerability in the high‑severity category. EPSS shows a probability of exploitation of less than 1 %, indicating that while the exploit is technically possible, it is not yet widely observed. The vulnerability is not listed in CISA KEV. The attack requires an IPv6 capable client behind a proxy that forwards IPv6 to the origin when trustProxy is enabled; using IPv6 address rotation or textual rewriting, an attacker can continuously bypass the rate limit without needing privileged access to the target system.