---
id: "CVE-2026-126204"
page: "https://infrastack.ai/live/CVE-2026-126204"
kind: "vulnerability"
aliases: ["CVE-2026-126204"]
title: "express-rate-limit: stale window reset lets clients burst past limit"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["express", "node", "npm", "package", "rate-limiting"]
not_affected_if: ["custom-store-fresh-date", "default-config", "other-version"]
published_at: "2026-11-12T19:16:56+00:00"
first_seen_at: "2026-11-12T19:40:13+00:00"
updated_at: "2026-11-12T19:41:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126204", "first_seen_at": "2026-11-12T19:40:13+00:00"}]
exploit_sources: []
---

# express-rate-limit: stale window reset lets clients burst past limit

Link for people: https://infrastack.ai/live/CVE-2026-126204 (this .md is for agents)

express-rate-limit versions 8.6.0 through 8.7.2 have a bug in the built-in MemoryStore where a request finishing after a window reset can decrement the new window's count. A client that keeps requests in flight across the window boundary can get up to one extra configured limit's worth of requests in the new window, without raising the sustained rate.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `npm ls express-rate-limit`
- Look for `skipFailedRequests` or `skipSuccessfulRequests` set to true in rate limiter configuration
- Confirm the store in use is the default MemoryStore, not a custom store that returns a fresh Date

## Fix

- `express-rate-limit` `8.7.2`

## Timeline

- 2026-11-12T19:40:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126204

## Documents

- [advisory] Vendor advisory: github.com https://github.com/express-rate-limit/express-rate-limit/security/advisories/GHSA-j3cq-92fq-qg5f
- [fix] Patch: github.com https://github.com/express-rate-limit/express-rate-limit/commit/da5b115b97dd903076d37b19437fbd71445e150b
- [fix] Release notes: github.com https://github.com/express-rate-limit/express-rate-limit/releases/tag/v8.7.2

## From the sources

express-rate-limit is a basic rate-limiting middleware for Express. From 8.6.0 until 8.7.2, the built-in MemoryStore returns a Client whose mutable resetTime object is retained by middleware using skipFailedRequests or skipSuccessfulRequests. When a later request resets the client window, MemoryStore.resetClient mutates that same Date, so an earlier request that finishes or disconnects after the reset can pass the stale-window guard and decrement the current window's count. A client able to keep requests in flight across the boundary can obtain a bounded extra burst of up to one additional configured limit in the new window; the behavior does not increase the sustained rate. Stores that return a fresh Date are not affected. This issue is fixed in version 8.7.2.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_