SCA: security update for express-rate-limit (GHSA-46wh-pxpv-q5gq)

high Tenable Cloud Security Plugin ID 438478

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- express-rate-limit is a basic rate-limiting middleware for Express. In versions starting from 8.0.0 and
prior to versions 8.0.2, 8.1.1, 8.2.2, and 8.3.0, the default keyGenerator in express-rate-limit applies
IPv6 subnet masking (/56 by default) to all addresses that net.isIPv6() returns true for. This includes
IPv4-mapped IPv6 addresses (::ffff:x.x.x.x), which Node.js returns as request.ip on dual-stack servers.
Because the first 80 bits of all IPv4-mapped addresses are zero, a /56 (or any /32 to /80) subnet mask
produces the same network key (::/56) for every IPv4 client. This collapses all IPv4 traffic into a single
rate-limit bucket: one client exhausting the limit causes HTTP 429 for all other IPv4 clients. This issue
has been patched in versions 8.0.2, 8.1.1, 8.2.2, and 8.3.0. (CVE-2026-30827)

Solution

Update the express-rate-limit library and its related packages to version 8.0.2 or later.

Plugin Details

Severity: High

ID: 438478

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 3/7/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-30827

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/6/2026

Vulnerability Publication Date: 3/6/2026

Reference Information

CVE: CVE-2026-30827

cwe: CWE-770

Detections

Analytics