CVE-2026-126204
express-rate-limit skipFailedRequests / skipSuccessfulRequests: with the default MemoryStore, a request from an earlier window is still un-counted from the current window
- Low 3.7
Description
express-rate-limit is a basic rate-limiting middleware for Express. From 8.6.0 until 8.7.2, the built-in MemoryStore returns a Client whose mutable resetTime object is retained by middleware using skipFailedRequests or skipSuccessfulRequests. When a later request resets the client window, MemoryStore.resetClient mutates that same Date, so an earlier request that finishes or disconnects after the reset can pass the stale-window guard and decrement the current window's count. A client able to keep requests in flight across the boundary can obtain a bounded extra burst of up to one additional configured limit in the new window; the behavior does not increase the sustained rate. Stores that return a fresh Date are not affected. This issue is fixed in version 8.7.2.
Key facts
- Published
- 12 Nov 2026
- Last changed
- 13 Nov 2026
- Assigned by
- GitHub_M
- EPSS
- 0.275% likely to be exploited in the next 30 days, higher than 20.108% of CVEs (scores for 15 Nov 2026)
- SSVC (CISA)
- Exploitation: none; Automatable: no; Technical impact: partial
Severity scores
Each score is shown as its source gave it. They are not averaged or merged.
- 3.7CVSS 3.1, Lowfrom the CNA (GitHub_M)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.
No explicit remediation statement is available on this page yet. Consult the original record and vendor references before choosing a fix.
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| express-rate-limit | express-rate-limit |
|
Timeline
- 12 Nov 2026 Published
Weakness
References
- https://github.com/express-rate-limit/express-rate-limit/security/advisories/GHSA-j3cq-92fq-qg5f
- https://github.com/express-rate-limit/express-rate-limit/pull/707
- https://github.com/express-rate-limit/express-rate-limit/commit/da5b115b97dd903076d37b19437fbd71445e150b
- https://github.com/express-rate-limit/express-rate-limit/releases/tag/v8.7.2