Executive brief
Hono's IP Restriction Middleware validates client IP addresses to enforce access control policies. A flaw in the IPv4 validation logic allows attackers to craft malformed IP addresses (e.g., 1.2.2.355) that bypass blocklists or spoof authorized IPs, potentially granting unauthorized access to protected resources.
Technical details
The vulnerability exists in the IPV4_REGEX pattern and convertIPv4ToBinary function in src/utils/ipaddr.ts. The regex accepts octet values greater than 255 (e.g., 999), and the binary conversion function performs unsafe bit-shift operations without validating octet ranges. When an octet exceeds 255, it overflows into adjacent octets; for example, 1.2.2.355 converts to the same binary value as 1.2.3.99. This is exploitable when applications rely on client-provided IP addresses (e.g., X-Forwarded-For headers) for access decisions. Attackers can bypass IP-based blocklists or allowlists. The vulnerability affects all versions before 4.11.7, which includes the fix.
Affected products
- Hono Hono < 4.11.7
Timeline
- 2026-01-27: disclosed