Hono: IP Restriction bypasses static deny rules for non-canonical IPv6
No sign of exploitation. No public exploitation artifact known so far.
Hono's IP blocking feature can be bypassed when IPv6 addresses are written in different formats. An attacker can use alternative representations of a blocked IP address (like compressed or expanded forms) to bypass security rules meant to deny access.
The ip-restriction middleware in Hono performs incomplete normalization of IPv6 addresses before string comparison against deny/allow rules. Non-canonical IPv6 representations (compressed forms, zero-expanded forms, hex-notation IPv4-mapped addresses) fail to match static rule entries, allowing bypass of IP-based access controls. Attack vector is network-based with no authentication required; impact is circumvention of IP-based security policies.