Misskey is an open source, federated social media platform. Attackers who use an untrusted reverse proxy or not using a reverse proxy at all can bypass IP rate limiting by adding a forged X-Forwarded-For header. Starting with version 2025.9.1, an option (`trustProxy`) has been added in config file to prevent this from happening. However, it is initialized with an insecure default value before version 2025.12.0-alpha.2, making it still vulnerable if the configuration is not set correctly. This is patched in v2025.12.0-alpha.2 by flipping default value of `trustProxy` to `false`. Users of a trusted reverse proxy who are unsure if they manually overode this value should check their config for optimal behavior. Users are running Misskey with a trusted reverse proxy should not be affected by this vulnerability. From v2025.9.1 to v2025.11.1, workaround is available. Set `trustProxy: false` in config file.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/misskey-dev/misskey/commit/5512898463fa8487b9e6488912f35102b91f25f7 Patch
- https://github.com/misskey-dev/misskey/security/advisories/GHSA-wwrj-3hvj-prpm Exploit, Vendor Advisory
- https://github.com/misskey-dev/misskey/security/advisories/GHSA-wwrj-3hvj-prpm Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.9 · misskeyNVD modified 2026-10-14 13:10
Affected (CPE criteria) 37
cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:-:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta16:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta21:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta22:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta23:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta24:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta25:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta26:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta27:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta28:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta29:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta30:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta31:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta32:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta33:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta34:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta35:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta36:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta37:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta38:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta39:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta40:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta41:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta42:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:beta43:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:rc1:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:rc10:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:rc11:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:rc2:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:rc3:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:rc4:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:rc5:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:rc6:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:rc7:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:rc8:*:*:*:*:*:*cpe:2.3:a:misskey:misskey:13.0.0:rc9:*:*:*:*:*:*