ZeroDay Findings
Sign inSign up

Findings

CVE-2026-47674

Hono is a Web application framework that provides support for any JavaScript runtime.

Published May 28, 2026 · updated Oct 14, 2026 · hono hono

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule — such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses — do not match the normalized rule entry, causing the rule to be silently skipped. This vulnerability is fixed in 4.12.21.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. May 28, 2026 · NIST NVD

    Detected

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule — such as compressed forms, explicit-zero

  2. Oct 14, 2026 · NIST NVD

    Updated

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule — such as compressed forms, explicit-zero

Affected

  • cpe hono/honoversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-47674

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-47674

    30-day exploitation probability 0.3%

    first.org
  • NIST NVDVulnerability recordCVE-2026-47674

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. No

    nvd.nist.gov

References

CVE-2026-47674 · ZeroDay Findings