VYPR
← All advisories
Moderate severityOSV Advisory· Published Dec 15, 2025· Updated Dec 16, 2025

Misskey has a login rate limit bypass via spoofed X-Forwarded-For header

CVE-2025-66482

Description

Misskey is an open source, federated social media platform. Attackers who use an untrusted reverse proxy or not using a reverse proxy at all can bypass IP rate limiting by adding a forged X-Forwarded-For header. Starting with version 2025.9.1, an option (trustProxy) has been added in config file to prevent this from happening. However, it is initialized with an insecure default value before version 2025.12.0-alpha.2, making it still vulnerable if the configuration is not set correctly. This is patched in v2025.12.0-alpha.2 by flipping default value of trustProxy to false. Users of a trusted reverse proxy who are unsure if they manually overode this value should check their config for optimal behavior. Users are running Misskey with a trusted reverse proxy should not be affected by this vulnerability. From v2025.9.1 to v2025.11.1, workaround is available. Set trustProxy: false in config file.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
misskey-jsnpm
>= 2025.9.1, < 2025.12.0-alpha.22025.12.0-alpha.2

Affected products

1

Patches

1
5512898463fa

Merge commit from fork

https://github.com/misskey-dev/misskeyKagami Sascha RosylightDec 3, 2025via ghsa
commit
2 files changed · +3 −3
  • .config/example.yml+2 −2 modified
    @@ -110,10 +110,10 @@ port: 3000
 # Changes how the server interpret the origin IP of the request.
 #
 # Any format supported by Fastify is accepted.
-# Default: trust all proxies (i.e. trustProxy: true)
+# Default: do not trust any proxies (i.e. trustProxy: false)
 # See: https://fastify.dev/docs/latest/reference/server/#trustproxy
 #
-# trustProxy: 1
+# trustProxy: false
 
 #   ┌──────────────────────────┐
 #───┘ PostgreSQL configuration └────────────────────────────────
  • packages/backend/src/server/ServerService.ts+1 −1 modified
    @@ -75,7 +75,7 @@ export class ServerService implements OnApplicationShutdown {
 	@bindThis
 	public async launch(): Promise<void> {
 		const fastify = Fastify({
-			trustProxy: this.config.trustProxy ?? true,
+			trustProxy: this.config.trustProxy ?? false,
 			logger: false,
 		});
 		this.#fastify = fastify;

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.