GHSA-xpcf-pg52-r92g
Suggest an improvement- Source
- https://github.com/advisories/GHSA-xpcf-pg52-r92g
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xpcf-pg52-r92g/GHSA-xpcf-pg52-r92g.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-xpcf-pg52-r92g
- Aliases
-
- CVE-2026-39409
- Downstream
- Related
- Published
- 2026-04-08T00:17:14Z
- Modified
- 2026-04-09T00:59:13.913628573Z
- Severity
-
- 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses
- Details
-
Summary
ipRestriction()does not canonicalize IPv4-mapped IPv6 client addresses (e.g.::ffff:127.0.0.1) before applying IPv4 allow or deny rules. In environments such as Node.js dual-stack, this can cause IPv4 rules to fail to match, leading to unintended authorization behavior.Details
The middleware classifies client addresses based on their textual form. Addresses containing "
:" are treated as IPv6, including IPv4-mapped IPv6 addresses such as::ffff:127.0.0.1. These addresses are not normalized to IPv4 before matching.As a result:
- IPv4 static rules (e.g.
127.0.0.1) do not match because the raw string differs - IPv4 CIDR rules (e.g.
127.0.0.0/8,10.0.0.0/8) are skipped because the address is treated as IPv6
For example, with:
denyList: ['127.0.0.1']a request from
127.0.0.1may be represented as::ffff:127.0.0.1and bypass the deny rule.This behavior commonly occurs in Node.js environments where IPv4 clients are exposed as IPv4-mapped IPv6 addresses.
Impact
Applications that rely on IPv4-based
ipRestriction()rules may incorrectly allow or deny requests.In affected deployments, a denied IPv4 client may bypass access restrictions. Conversely, legitimate clients may be rejected when using IPv4 allow lists.
- IPv4 static rules (e.g.
- Database specific
{ "github_reviewed": true, "nvd_published_at": "2026-04-08T15:16:14Z", "github_reviewed_at": "2026-04-08T00:17:14Z", "cwe_ids": [ "CWE-180" ], "severity": "MODERATE" }- References
Affected packages
npm / hono
Package
- Name
- hono
- View open source insights on deps.dev
- Purl
- pkg:npm/hono