npm / express-rate-limit
express-rate-limit
What changed in express-rate-limit 6 to 7, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-29.
14 breaking2 deprecations3 new APIs and options8 behavior and defaults1 tooling
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initexpress-rate-limit 78 changes
Breaking changes 5
The deprecated option was removed; use standardHeaders: 'draft-6' instead.
Setting max to 0 now blocks all requests instead of allowing them through; use skip to replicate the old behavior.
The minimum required Node version changed from v14 to v16.
The deprecated option was removed; a custom handler option can replicate its behavior.
Renames req.rateLimit.current to req.rateLimit.used; current remains as a hidden getter but is omitted from key iteration and JSON.stringify().
Deprecations 1
The limit configuration option is now preferred over max, though max remains supported and behavior is unchanged.
New APIs and options 1
The validate config option can now be an object with keys to enable or disable specific validation checks.
Behavior and default changes 1
MemoryStore now uses precise, per-user reset times instead of a global window that resets all users at once.
express-rate-limit 620 changes
Breaking changes 9
The deprecated option is removed; delay functionality moved to express-slow-down.
The deprecated option is removed; delay functionality moved to express-slow-down.
express 4.x is now a peer dependency.
The deprecated option is removed; use a key generator that returns a constant value.
The custom store method incr is renamed to increment.
Renames the headers option to legacyHeaders.
The deprecated method is removed; use limiter.resetKey instead.
The package now requires NodeJS version 12.9.0 or greater.
Renames the draft_polli_ratelimit_headers option to standardHeaders.
Deprecations 1
The configuration option is deprecated; replace it with a custom handler that checks the number of hits.
New APIs and options 2
The package is exported as both ESM and CJS.
Custom stores can implement init to set themselves up using options passed to the middleware.
Behavior and default changes 7
Old stores are automatically promisified and used.
Custom store decrement can now return a promise.
Custom store increment can now return a promise.
keyGenerator can now be an async function or return a promise.
Custom store resetAll can now return a promise.
Custom store resetKey can now return a promise.
The header is now sent if either legacyHeaders or standardHeaders is set.
Tooling 1
Typescript support is improved; the library was rewritten in Typescript.