Limit not working? Rate Limit not honored as the Request Volumes Increase

[charlieding]

I set the rate limit at 3 TPS. When I send 4 TPS, it works and I see 3TPS rate honored. However, when I put this into production, as the volumes go up, 3 TPS begins to break.
AT 10 TPS INPUT, I see ~4 TPS getting through the rate limiter.
AT 40 TPS INPUT, I see ~6 TPS getting through the rate limiter.

Any help is appreciated.

var limiter = require('express-limiter')(router, client);
limiter({
path: '/',
method: 'post',
onRateLimited: function (req, res, next) {
next({ message: 'Rate limit exceeded', status: 429 })
},
lookup: function(req, res, opts, next) {
opts.lookup = 'headers.id';
opts.total = 3; // 1 TPS
}
return next();
},
expire: 1000 // (1 seconds)
});

[animir]

This package uses Get/Set approach, which is vulnerable on high traffic. Similar vulnerability was found on express-brute package.

rate-limiter-flexible package implements atomic increments.