CVE-2026-39409: Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

April 8, 2026 (updated April 24, 2026)

ipRestriction() does not canonicalize IPv4-mapped IPv6 client addresses (e.g. ::ffff:127.0.0.1) before applying IPv4 allow or deny rules. In environments such as Node.js dual-stack, this can cause IPv4 rules to fail to match, leading to unintended authorization behavior.

References

github.com/advisories/GHSA-xpcf-pg52-r92g
github.com/honojs/hono/commit/48fa2233bc092f650119f42df043050737cabf39
github.com/honojs/hono/releases/tag/v4.12.12
github.com/honojs/hono/security/advisories/GHSA-xpcf-pg52-r92g
nvd.nist.gov/vuln/detail/CVE-2026-39409

Code Behaviors & Features

Detect and mitigate CVE-2026-39409 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →