# animir/node-rate-limiter-flexible

Atomic and non-atomic counters and rate limiting tools. Limit resource access at any scale.

Repository: https://github.com/animir/node-rate-limiter-flexible
Canonical: https://ross.abutalabs.com/products/node-rate-limiter-flexible
Language: JavaScript
License: ISC
License Family: permissive
Topics: security, limit, ratelimter, bruteforce, throttle, koa, express, hapi, nestjs, rate-limiting, dynamodb, postgresql, redis, prisma, valkey, sqlite, drizzle
Last push: 2026-06-08T17:55:21+00:00

## Health v2 (maintenance only)
Score: 89/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 86, release rhythm 87, longevity 100
- inputs: {"age_days": 3041, "days_push": 86, "days_rel": 86, "gap_med": 13, "n_releases_24m": 26}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 3581, forks 195 (observed 2026-08-28T04:08:10.976626+00:00)

## What it is
A Node.js/Deno library for counting and limiting events with atomic rate limiting across many backends including Redis, Valkey, Memcached, MongoDB, DynamoDB, MySQL, PostgreSQL, SQLite, Prisma, and in-process memory. It provides a unified API to throttle requests, block keys, and protect against DoS and brute force attacks at any scale.

## Use cases
- rate limit api requests per ip address
- protect login endpoint from brute force attacks
- throttle requests in express or koa middleware
- distributed rate limiting across multiple servers with redis
- limit user actions like password resets or otp requests
- prevent dos attacks on nodejs application
- rate limiting without external store using in-memory counters

## When to choose
- you need a unified rate limiter API that can switch between memory, Redis, and SQL/NoSQL stores as your app scales
- you need atomic increments to avoid race conditions in distributed environments
- you use Express, Koa, Hapi, or NestJS and need drop-in throttling middleware
- you need features like key blocking, action delays, and insurance/failover options

## When to avoid
- you need advanced algorithms like token bucket or sliding window log with precise guarantees
- you are not on a JavaScript runtime (Node.js, Deno, or browser)
- you only need simple HTTP-level rate limiting already provided by your API gateway or reverse proxy

## Facets
- artifact type: library
- maturity: stable
- function: rate-limiting, security, caching, middleware
- domain: security, web-development, backend, apis, developer-tools
- platform: browser, cross-platform
- tags: brute-force-protection, dos-protection, throttling, express, koa, nestjs, redis, dynamodb, postgresql, memcached, mongodb, sqlite, fixed-window, distributed-rate-limiting, nodejs, deno, web-server

## Member repositories
- animir/node-rate-limiter-flexible (main) score 89

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:10.976626+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:33:58.147922+00:00, confidence not recorded.
  - readme: https://github.com/animir/node-rate-limiter-flexible (fetched 2026-08-28T04:08:10.976626+00:00, sha 53edf2ee536e)
- Data as of 2026-08-30T08:39:29.467469+00:00.