Misskey has a login rate limit bypass via spoofed X-Forwarded-For header

Description

When using an untrusted reverse proxy or not using a reverse proxy at all, attackers can bypass IP rate limiting by adding a forged X-Forwarded-For header. Starting with version 2025.9.1, an option (trustProxy) has been added in config file to prevent this from happening.

Recommendation

Update the misskey-js package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2025.9.1, < 2025.12.0-alpha.2
• Patched version(s): 2025.12.0-alpha.2

References

• GHSA-wwrj-3hvj-prpm
• CVE-2025-66482
• CWE-1188
• CWE-307
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying - CVE-2025-64526
• FUXA has JWT Authentication Bypass via HTTP Referer header spoofing - CVE-2025-69985
• OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data ex - CVE-2026-30956
• LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter - CVE-2026-34166

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

misskey-js