Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-39409: Hono may misapply IP allow/deny rules

CVE-2026-39409 · published 7 months ago

Summary

The Hono web framework can treat IPv4‑mapped IPv6 addresses (like ::ffff:127.0.0.1) as different from plain IPv4 addresses. Because of this, IP‑based allow or block lists may not work correctly, potentially letting traffic through that should be blocked. Upgrade to version 4.12.12 or later to fix the problem.

What to do

Update yusukebe hono to version 4.12.12.
Update GitHub Actions hono to version 4.12.12.
Update GitHub Actions hono to version 4.12.12-aikido.1.
Update rootio @rootio/hono to version 4.12.12-root.io.1.
Update GitHub Actions hono to version 4.12.12-aikido.2.
Update rootio @rootio/hono to version 4.12.12-root.io.2.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	yusukebe	hono	< 4.12.12 Fix: upgrade to 4.12.12
npm	GitHub Actions	hono	< 4.12.12 Fix: upgrade to 4.12.12
–	hono	hono	<= 4.12.11 `cpe:2.3:a:hono:hono::::::node.js::*`
Root:npm	GitHub Actions	hono	< 4.12.12-aikido.1 < 4.12.12-aikido.2 Fix: upgrade to 4.12.12-aikido.1
Root:npm	rootio	@rootio/hono	< 4.12.12-root.io.1 < 4.12.12-root.io.2 Fix: upgrade to 4.12.12-root.io.1

Original advisory text

Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, ipRestriction() does not canonicalize IPv4-mapped IPv6 client addresses (e.g. ::ffff:127.0.0.1) before applying IPv4 allow or deny rules. In environments such as Node.js dual-stack, this can cause IPv4 rules to fail to match, leading to unintended authorization behavior. This vulnerability is fixed in 4.12.12.

References

https://github.com/advisories/GHSA-xpcf-pg52-r92g
https://github.com/honojs/hono Product
https://github.com/honojs/hono/releases/tag/v4.12.12 URL
https://github.com/honojs/hono/commit/48fa2233bc092f650119f42df043050737cabf39 Patch
https://nvd.nist.gov/vuln/detail/CVE-2026-39409 Vendor Advisory
https://github.com/honojs/hono/security/advisories/GHSA-xpcf-pg52-r92g Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39409... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-180Incorrect Behavior Order: Validate Before Canonicalize

Timeline

Published8 Apr 2026

Updated4 Nov 2026

First seen8 Apr 2026

Sources

GHSA-xpcf-pg52-r92g · GHSA

CVE-2026-39409 · NVD

GHSA-xpcf-pg52-r92g · OSV

ROOT-APP-NPM-CVE-2026-39409 · OSV

CVE-2026-39409 · OSV

Track software like this

Free during beta