GHSA-r354-f388-2fhh

Suggest an improvement
Source
https://github.com/advisories/GHSA-r354-f388-2fhh
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-r354-f388-2fhh/GHSA-r354-f388-2fhh.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-r354-f388-2fhh
Aliases
Downstream
CGA (22)
MINI (2)
Published
2026-01-27T19:01:43Z
Modified
2026-09-10T03:50:59Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing
Details

Summary

IP Restriction Middleware in Hono is vulnerable to an IP address validation bypass. The IPV4_REGEX pattern and convertIPv4ToBinary function in src/utils/ipaddr.ts do not properly validate that IPv4 octet values are within the valid range of 0-255, allowing attackers to craft malformed IP addresses that bypass IP-based access controls.

Details

The vulnerability exists in two components:

  1. Permissive regex pattern: The IPV4_REGEX (/^[0-9]{0,3}\.[0-9]{0,3}\.[0-9]{0,3}\.[0-9]{0,3}$/) accepts octet values greater than 255 (e.g., 999).
  2. Unsafe binary conversion: The convertIPv4ToBinary function does not validate octet ranges before performing bitwise operations. When an octet exceeds 255, it overflows into adjacent octets during the bit-shift calculation.

For example, the IP address 1.2.2.355 is accepted and converts to the same binary value as 1.2.3.99:

  • 355 = 256 + 99 = 0x163
  • After bit-shifting: (1 << 24) + (2 << 16) + (2 << 8) + 355 = 0x01020363 = 1.2.3.99

Impact

An attacker can bypass IP-based restrictions by crafting malformed IP addresses:

  • Blocklist bypass: If 1.2.3.0/24 is blocked, an attacker can use 1.2.2.355 (or similar) to bypass the restriction.
  • Allowlist bypass: Requests from unauthorized IP ranges may be incorrectly permitted.

This is exploitable when the application relies on client-provided IP addresses (e.g., X-Forwarded-For header) for access control decisions.

Affected Components

  • IP Restriction Middleware
  • src/utils/ipaddr.ts: IPV4_REGEX, convertIPv4ToBinary, distinctRemoteAddr
Database specific 
{
    "cwe_ids":  [
        "CWE-185"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-01-27T19:01:43Z",
    "nvd_published_at":  "2026-01-27T19:16:16Z",
    "severity":  "MODERATE"
}
References

Affected packages

npm / hono

Package

Name
hono
View open source insights on deps.dev
Purl
pkg:npm/hono

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.11.7

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-r354-f388-2fhh/GHSA-r354-f388-2fhh.json"