CVE-2026-47674Medium· 5.3▾ SunlitHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using stri…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule — such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses — do not match the normalized rule entry, causing the rule to be silently skipped. This vulnerability is fixed in 4.12.21.
hono < 4.12.21Upgrade past the affected range:
hono 4.12.21Connected by shared product, vendor, weakness, or advisory.
CVE-2026-47676Medium· 5.3Hono is a Web application framework that provides support for any JavaScript runtime
CVE-2026-47673Medium· 4.8Hono is a Web application framework that provides support for any JavaScript runtime
CVE-2026-47675Medium· 4.3Hono is a Web application framework that provides support for any JavaScript runtime
CVE-2025-62610High· 8.1Hono is a Web application framework that provides support for any JavaScript runtime
GHSA-3wcj-gjvf-fvchMedium· 4.8Duplicate Advisory: Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })
GHSA-cw3j-28qq-x3xhMedium· 6.5Duplicate Advisory: Hono vulnerable to Vary Header Injection leading to potential CORS Bypass