← back
CVE-2026-47674mediumCWE-1289CWE-185

Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.2%
exploitation probability
0.2%top 84% of all CVEs
observed exploitation
nono source reports it
In short

Hono's IP blocking feature can be bypassed when IPv6 addresses are written in different formats. An attacker can use alternative representations of a blocked IP address (like compressed or expanded forms) to bypass security rules meant to deny access.

Technical detail

The ip-restriction middleware in Hono performs incomplete normalization of IPv6 addresses before string comparison against deny/allow rules. Non-canonical IPv6 representations (compressed forms, zero-expanded forms, hex-notation IPv4-mapped addresses) fail to match static rule entries, allowing bypass of IP-based access controls. Attack vector is network-based with no authentication required; impact is circumvention of IP-based security policies.

Summary generated and translated by AI from the official description.
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule — such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses — do not match the normalized rule entry, causing the rule to be silently skipped. This vulnerability is fixed in 4.12.21.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
honojs · hono