Executive brief
A vulnerability in the Hono web framework's IP restriction tool allows attackers to bypass security rules that block specific IP addresses. By using alternative ways to write an IPv6 address (such as adding extra zeros or using different formatting), an attacker can trick the system into ignoring the blocklist. This could allow unauthorized users to access private parts of a website or service that were supposed to be restricted to trusted locations.
Technical details
The `hono/ip-restriction` middleware performs IP address validation by comparing incoming request addresses against a list of canonicalized strings. However, while the rules themselves are normalized during setup, the incoming IP addresses are not normalized before comparison. Because IPv6 allows multiple valid string representations for the same address (e.g., compressed vs. expanded notation, or hex-notation IPv4-mapped addresses), an attacker can provide a non-canonical version of a blocked IP to bypass string-equality checks. Since static rules lack a CIDR prefix, they are also skipped during the subsequent CIDR matching phase. The vulnerability is fixed in version 4.12.21.
Affected products
- honojs hono < 4.12.21
Timeline
- 2026-05-19: disclosed
- 2026-05-28: advisory: NVD publication date
- 2026-06-04: patched: GitHub Advisory published/updated