express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting (all IPv4 clients share one bucket on dual-stack servers)

@@ -73,6 +73,9 @@
 		"pre-commit": "lint-staged",
 		"prepare": "run-s compile && husky"
 	},
+	"dependencies": {
+		"ip-address": "10.1.0"
+	},
 	"peerDependencies": {
 		"express": ">= 4.11"
 	},
@@ -105,8 +108,5 @@
 	"lint-staged": {
 		"*.{js,ts,json}": "biome check --write",
 		"*.{md,yaml}": "prettier --write"
-	},
-	"dependencies": {
-		"ip-address": "10.1.0"
 	}
 }

@@ -17,9 +17,21 @@ import { Address6 } from 'ip-address'
  * @public
  */
 export function ipKeyGenerator(ip: string, ipv6Subnet: number | false = 56) {
-	if (ipv6Subnet && isIPv6(ip)) {
+	if (isIPv6(ip)) {
+		const address = new Address6(ip)
+
+		// First, check if the address is IPv4 mapped to IPv6 (e.g., ::ffff:x.y.z.w),
+		// as is common on servers with dual-stack networks (both IPv4 and IPv6). If
+		// this is the case, we extract and return the IPv4 address. Otherwise, the
+		// default subnet value of 56 (or any 32 to 80 subnet) ignores the unique IP
+		// address in the last two octets completely.
+		if (address.is4()) return address.to4().correctForm()
+
 		// For IPv6, return the network address of the subnet in CIDR format
-		return `${new Address6(`${ip}/${ipv6Subnet}`).startAddress().correctForm()}/${ipv6Subnet}`
+		if (ipv6Subnet) {
+			const subnet = new Address6(`${ip}/${ipv6Subnet}`)
+			return `${subnet.startAddress().correctForm()}/${ipv6Subnet}`
+		}
 	}
 
 	// For IPv4, just return the IP address itself

@@ -6,12 +6,23 @@ describe('ipKeyGenerator', () => {
 		expect(ipKeyGenerator('1.2.3.4', 16)).toBe('1.2.3.4')
 	})
 
+	it('should return an IPv4 address mapped to IPv6 as an IPv4 address', () => {
+		expect(ipKeyGenerator('::ffff:1.2.3.4')).toBe('1.2.3.4')
+		expect(ipKeyGenerator('::1.2.3.4')).toBe('1.2.3.4')
+	})
+
 	it('should return an IPv6 address unchanged with ipv6Subnet set to false', () => {
 		expect(
 			ipKeyGenerator('0123:4567:89ab:cdef:0123:4567:89ab:cdef', false),
 		).toBe('0123:4567:89ab:cdef:0123:4567:89ab:cdef')
 	})
 
+	it('should apply ipv6Subnet only a true IPv6 address', () => {
+		expect(ipKeyGenerator('::1.2.3.4', 16)).toBe('1.2.3.4')
+		expect(ipKeyGenerator('::ffff:1.2.3.4', 16)).toBe('1.2.3.4')
+		expect(ipKeyGenerator('::1.2.3.4', false)).toBe('1.2.3.4')
+	})
+
 	it('should apply a default /56 netmask to an IPv6 address', () => {
 		expect(ipKeyGenerator('0123:4567:89ab:cdef:0123:4567:89ab:cdef')).toBe(
 			'123:4567:89ab:cd00::/56',