Vulnerability in Honojs Hono
CVE-2026-39409
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, ipRestriction() does not canonicalize IPv4-mapped IPv6 client addresses (e.g. ::ffff:127.0.0.1) before applying IPv4 allow or deny rule…
EPSS: 0.000 (2.4th percentile) — read the EPSS interpretation.
Affected products
- Honojs Hono — versions < 4.12.12
Weakness classification (CWE)
References
- https://github.com/honojs/hono/security/advisories/GHSA-xpcf-pg52-r92g (x_refsource_CONFIRM)
- https://github.com/honojs/hono/commit/48fa2233bc092f650119f42df043050737cabf39 (x_refsource_MISC)
- https://github.com/honojs/hono/releases/tag/v4.12.12 (x_refsource_MISC)