Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

Description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule — such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses — do not match the normalized rule entry, causing the rule to be silently skipped. This vulnerability is fixed in 4.12.21.

Timeline

Scores

EPSS (exploitation in 30 days)

0.24% · top 84% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

• CWE-185: Incorrect Regular Expression (opens in a new tab)All about CWE-185 and its CVEs
• CWE-1289: Improper Validation of Unsafe Equivalence in Input (opens in a new tab)All about CWE-1289 and its CVEs

Affected products

• honojs · hono

  • affected < 4.12.21

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• npmhonoGHSA-xrhx-7g5j-rcj5 (opens in a new tab)

References (1)

• https://github.com/honojs/hono/security/advisories/GHSA-xrhx-7g5j-rcj5 (opens in a new tab)x_refsource_CONFIRM

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-xrhx-7g5j-rcj5 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-47674](https://trackcve.app/badge/CVE-2026-47674.svg)](https://trackcve.app/cve/CVE-2026-47674)

Record last updated 2 Jun 2026, 18:15 UTC.