GHSA-xpcf-pg52-r92g CVE-2026-39409
Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.34%
- Chance of exploitation in the next 30 days. Higher than 27.83% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-180 Incorrect Behavior Order: Validate Before Canonicalize
- Fix
4.12.12- Upgrade hono to this version or later
Description
Summary
ipRestriction() does not canonicalize IPv4-mapped IPv6 client addresses (e.g. ::ffff:127.0.0.1) before applying IPv4 allow or deny rules. In environments such as Node.js dual-stack, this can cause IPv4 rules to fail to match, leading to unintended authorization behavior.
Details
The middleware classifies client addresses based on their textual form. Addresses containing ":" are treated as IPv6, including IPv4-mapped IPv6 addresses such as ::ffff:127.0.0.1. These addresses are not normalized to IPv4 before matching.
As a result:
- IPv4 static rules (e.g.
127.0.0.1) do not match because the raw string differs - IPv4 CIDR rules (e.g.
127.0.0.0/8,10.0.0.0/8) are skipped because the address is treated as IPv6
For example, with:
denyList: ['127.0.0.1']
a request from 127.0.0.1 may be represented as ::ffff:127.0.0.1 and bypass the deny rule.
This behavior commonly occurs in Node.js environments where IPv4 clients are exposed as IPv4-mapped IPv6 addresses.
Impact
Applications that rely on IPv4-based ipRestriction() rules may incorrectly allow or deny requests.
In affected deployments, a denied IPv4 client may bypass access restrictions. Conversely, legitimate clients may be rejected when using IPv4 allow lists.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| hono | < 4.12.12 |
4.12.12 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
hono npm → 4.12.12
- npm
npm install hono@4.12.12- yarn
yarn add hono@4.12.12- pnpm
pnpm add hono@4.12.12
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Weakness
CWE-180: Incorrect Behavior Order: Validate Before Canonicalize
The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.
How to prevent it
- Implementation: Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-5r4p-p66f-jhc7 Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths | Medium | Also affects hono |
| GHSA-hxh3-vqpv-xpqv hono/jsx renders plain strings unescaped in boundary components, leading to XSS | Low | Also affects hono |
| GHSA-gqvv-2mrq-wpjv Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory | Medium | Also affects hono |
| GHSA-g6gw-c38x-mqfc Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion | Medium | Also affects hono |
| GHSA-crvj-82cr-hjcx Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials | Medium | Also affects hono |
| GHSA-f23p-vx2j-j53r Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure | Medium | Also affects hono |
| GHSA-79qm-7rj5-m7r9 Hono: Proxy Helper does not remove response headers listed in the `Connection` header | Low | Also affects hono |
| GHSA-54fx-42gc-7vw4 Hono: Algorithmic Complexity DoS in Language Middleware | Medium | Also affects hono |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor