The vulnerability arises from express‑rate‑limit treating IPv4‑mapped IPv6 addresses as a single subnet due to the default keyGenerator applying /56 masking to any address reported as IPv6. All IPv4 clients share the same network key, collapsing them into one rate‑limit bucket. When one such client exceeds the threshold, the middleware returns HTTP 429 for every IPv4 client on the server, effectively denying service to all non‑bypassable traffic. This weakness exposes a denial‑of‑service impact classified under CWE‑1389 and CWE‑770. Based on the description, it is inferred that the patch replaces the default key generation so that IPv4‑mapped addresses are separated from each other or handled like native IPv4 addresses, restoring client‑specific rate limits. The affected Node.js applications expose the issue only on dual‑stack servers where requests from IPv4 clients are presented as IPv4‑mapped IPv6 values, typically via request.ip.

The issue affects the express‑rate‑limit npm package, specifically versions 8.0.0 through 8.0.1, 8.1.0, 8.2.0‑8.2.1, and any pre‑patch release older than 8.0.2, 8.1.1, 8.2.2, or 8.3.0. Environment impact is Node.js Express applications that rely on the default rate‑limiting middleware and run on dual‑stack network stacks or where IPv6 is enabled.

The vulnerability carries a CVSS score of 7.5, placing it in the high severity range. EPSS indicates an exploitation probability of less than 1%, suggesting relatively low activity, and it is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that attackers can exploit this remotely by sending excessive requests from a single IPv4 client on a dual‑stack server, triggering the shared bucket. The impact is the denial of service to all other IPv4 clients. While the flaw is network‑accessible, it does not require privileged credentials or local access, making it feasible for attackers controlling a single client connection, based on the description. The likely attack vector involves a remote client manipulating request.ip over IPv6 to trigger the shared bucket. The effective attack surface is the rate‑limit configuration exposed by express‑rate‑limit in production deployments.