Description
When using an untrusted reverse proxy or not using a reverse proxy at all, attackers can bypass IP rate limiting by adding a forged X-Forwarded-For header. Starting with version 2025.9.1, an option (trustProxy) has been added in config file to prevent this from happening.
Recommendation
Update the misskey-js package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2025.9.1, < 2025.12.0-alpha.2
- Patched version(s): 2025.12.0-alpha.2
References
Could your website be exposed too?
SmartScanner can check your website for Misskey has a login rate limit bypass via spoofed X-Forwarded-For header and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying - CVE-2025-64526
- FUXA has JWT Authentication Bypass via HTTP Referer header spoofing - CVE-2025-69985
- OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data ex - CVE-2026-30956
- LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter - CVE-2026-34166
You might also like:
See something that needs correcting? Let us knowUpdated January 06, 2026