PT-2026-4917 · Hono · Hono

Devanshbatham · Published 2026-01-27 · Updated 2026-02-04 · CVE-2026-24398

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.11.7

Description The IP Restriction Middleware in Hono does not properly validate IPv4 addresses, allowing attackers to bypass IP-based access controls. The IPV4 REGEX pattern and convertIPv4ToBinary function in src/utils/ipaddr.ts fail to ensure that IPv4 octet values are within the valid range of 0-255. This allows the creation of malformed IP addresses that circumvent intended restrictions.

Recommendations Update to version 4.11.7 or later.

Exploit

Fix

Weakness Enumeration

CWE-185

Related Identifiers

CVE-2026-24398

GHSA-R354-F388-2FHH

Affected Products

Hono

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24398.json · Exploit
• https://github.com/honojs/hono/commit/edbf6eea8e6c26a3937518d4ed91d8666edeec37 · Patch
• https://github.com/honojs/hono/security/advisories/GHSA-r354-f388-2fhh · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r354-f388-2fhh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24398 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24398 · Vendor Advisory
• https://github.com/honojs/hono · Note
• https://github.com/honojs/hono/releases/tag/v4.11.7 · Note
• https://twitter.com/_cvereports/status/2016302865514381575 · Twitter Post
• https://twitter.com/UndercodeUpdate/status/2016120166006837460 · Twitter Post
• https://t.me/cveNotify/150863 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2016246018036162956 · Twitter Post
• https://twitter.com/CVEnew/status/2016235065592971763 · Twitter Post
• https://twitter.com/0xAsm0d3us/status/2016093294242234676 · Twitter Post