CVE-2026-39409CWE-180

Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

Medium · published April 8, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
33.7
In the wild
Unconfirmed
What it is

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, ipRestriction() does not canonicalize IPv4-mapped IPv6 client addresses (e.g. ::ffff:127.0.0.1) before applying IPv4 allow or deny rules. In environments such as Node.js dual-stack, this can cause IPv4 rules to fail to match, leading to unintended authorization behavior. This vulnerability is fixed in 4.12.12.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00405 · 33.7th percentile
Weakness
CWE-180 · Incorrect Behavior Order: Validate Before Canonicalize
Published
2026-04-08T14:43Z
EPSS history
Timeline
  • 08 APR 14:43Z
    Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses
    cvelistv5