express-rate-limit/express-rate-limit
Last release:
express-rate-limit is a basic rate-limiting middleware for the Express web server. It helps limit repeated requests to public APIs or endpoints (for example, password reset), with configurable limits, response behavior when exceeded, and support for in-memory and external data stores.
Project status
- Actively maintained: Recent upstream push (2026-07-20) and a new tagged update shortly before that (v8.6.0 on 2026-07-16) indicate the project is current and being actively worked on.
- Apparent update cadence: In 2026 there are multiple updates clustered in spring to mid-summer (2026-04-23/24, 2026-05-04, 2026-05-06, 2026-05-14, 2026-07-16), suggesting an active cadence of roughly every few weeks to a couple months.
AI summary generated
Recent updates
v8.6.0
v8.6.0 adds time constants (DAY, HOUR, MINUTE, SECOND), and introduces Express Rate Limit debug logging (via the `debug` and `DEBUG` environment variable) plus updated documentation around debugging. It also changes validation execution so each validation check disables itself after first run, and fixes a correctness issue where `used` could go negative under `skipSuccessfulRequests` or `skipFailedRequests` when the window reset during request handling.
Featuresv8.5.2
v8.5.2 makes a small runtime change to IPv6 key generation in ipKeyGenerator, alongside multiple lockfile updates. Most of the diff volume is dependency/tooling version changes rather than feature work.
Breakingv8.5.1
Release v8.5.1 primarily updates the `ip-address` dependency to address a reported security issue. The provided release notes do not enumerate any changes beyond a link to an external changelog.
v8.5.0
v8.5.0 introduces support for store initialization that can be async, by allowing store.init to return a promise and by handling init failures gracefully. The core middleware now catches synchronous throws and promise rejections from store.init and logs them without blocking the middleware from being created or used.
Featuresv8.4.1
v8.4.1 introduces a new `logger` option to control how express-rate-limit logs validation errors and store errors. The implementation routes internal warnings and errors through the provided logger (defaulting to a console-based logger) and adds runtime validation of the logger shape.
BreakingFeaturesv8.4.0
Although the provided release notes only link to an external changelog, the code diff shows this version (v8.4.0) primarily adds documentation for a new `logger` configuration option for express-rate-limit. The diff also includes a change to a middleware test to increase timeout and skip a flaky test on macOS (darwin).
Featuresv8.3.2
v8.3.2 primarily updates the middleware internals and dev tooling. The code change focuses on ensuring decrement logic is not missed when requests close very early while `skipFailedRequests` is enabled.
v8.3.1
v8.3.1 is presented as a maintenance release, with changelog entries indicating fixes for npm provenance on automated releases and a broken readme link. The actual diff provided shows no changes to the runtime Express middleware implementation, but does include updates to tooling, CI configuration, and development dependencies.
v8.3.0
v8.3.0 updates the project tooling and documentation site config, and includes an actual behavior change in the core IP key generation logic. The most impactful change is in `ipKeyGenerator`, which now detects IPv4-mapped IPv6 addresses (for example, `::ffff:1.2.3.4`) and returns the mapped IPv4 form instead of treating it as a normal IPv6 address subnet.
Breakingv8.2.1
Release v8.2.1 primarily adjusts option validation behavior. It adds compatibility for options used by express-slow-down (delayAfter, delayMs, maxDelayMs) so the middleware avoids logging ERR_ERL_UNKNOWN_OPTION-related warnings in those cases.
v8.2.0
Release v8.2.0 is presented with minimal release notes content, only pointing to an external changelog. The code diff shows a new configuration validation feature added to the runtime middleware, plus several development tooling and type-checking dependency updates.