CVE-2026-47674

Description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule — such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses — do not match the normalized rule entry, causing the rule to be silently skipped. This vulnerability is fixed in 4.12.21.

Traduire en français

Produits concernés

• honojs hono
• Hono hono

Scores CVSS

Faiblesses (CWE)

• CWE-185
• CWE-1289

Références

• https://github.com/honojs/hono/security/advisories/GHSA-xrhx-7g5j-rcj5 Vendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories