Improper Enforcement of Behavioral Workflow Affecting express-rate-limit package, versions <8.7.2

express-rate-limit is a Basic IP rate-limiting middleware for Express. Use to limit repeated requests to public APIs and/or endpoints such as password reset.

Affected versions of this package are vulnerable to Improper Enforcement of Behavioral Workflow via MemoryStore.resetClient mutating the shared resetTime Date object in place when skipFailedRequests or skipSuccessfulRequests is enabled. MemoryStore.increment returns the stored Client object directly, so the middleware's resetTime reference and the store's client.resetTime point to the same Date. When a subsequent request triggers resetClient, it calls client.resetTime.setTime(now + windowMs), advancing that shared Date forward. An earlier request still in flight then finishes or disconnects after the window boundary, reads the now-updated reset time, passes the stale-window guard at rate-limit.ts:545-547, and decrements the new window's hit count. A client that keeps requests in flight across a window boundary can thereby obtain up to one additional configured limit worth of requests in the new window as a one-off burst.

Note: This is only exploitable when the default MemoryStore is used together with the skipFailedRequests or skipSuccessfulRequests option.

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release