PT-2026-31283 · Hono · Hono

Published 2026-04-08 · Updated 2026-05-18 · CVE-2026-39409

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.12

Description The ipRestriction() function does not properly handle IPv4-mapped IPv6 client addresses (e.g., ::ffff:127.0.0.1) when applying IPv4 allow or deny rules. In dual-stack environments like Node.js, this can lead to IPv4 rules failing to match, resulting in incorrect authorization. The middleware classifies client addresses based on their textual form, treating IPv4-mapped IPv6 addresses as IPv6 and skipping IPv4 CIDR rules. This can allow denied IPv4 clients to bypass access restrictions or cause legitimate clients to be incorrectly rejected.

Recommendations Update to Hono version 4.12.12 or later.

Fix

Weakness Enumeration

CWE-180

Related Identifiers

CLEANSTART-2026-BE61221

CVE-2026-39409

GHSA-XPCF-PG52-R92G

Affected Products

Hono

References · 174

• https://github.com/honojs/hono/commit/48fa2233bc092f650119f42df043050737cabf39 · Patch
• https://github.com/honojs/hono/security/advisories/GHSA-xpcf-pg52-r92g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30827 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42036 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4926 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39409 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-6322 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33937 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4923 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42044 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42038 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34043 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42034 · Security Note
• https://osv.dev/vulnerability/GHSA-xpcf-pg52-r92g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42037 · Security Note