{"id":"EUVD-2026-32926","enisaUuid":"a3289e6e-ac3c-3e48-b2c3-abbe7c6ae9ce","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule — such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses — do not match the normalized rule entry, causing the rule to be silently skipped. This vulnerability is fixed in 4.12.21.","datePublished":"May 28, 2026, 3:29:08 PM","dateUpdated":"Jun 2, 2026, 6:15:02 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-xrhx-7g5j-rcj5\n","aliases":"CVE-2026-47674\nGHSA-xrhx-7g5j-rcj5\n","assigner":"GitHub_M","epss":0.24,"enisaIdProduct":[{"id":"802b5575-b568-367e-a474-1dd95e5410b7","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"\u003c 4.12.21"}],"enisaIdVendor":[{"id":"e35ecb0e-3f40-300e-9906-1420611b0800","vendor":{"name":"honojs"}}],"enisaIdVulnerability":[{"id":"42744571-febd-37de-8aac-44718eb58f31","vulnerability":{"id":"GHSA-xrhx-7g5j-rcj5","description":"Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 ","datePublished":"Jun 4, 2026, 6:00:22 PM","dateUpdated":"Jun 4, 2026, 6:00:22 PM","baseScore":0.0,"references":"https://github.com/honojs/hono/security/advisories/GHSA-xrhx-7g5j-rcj5\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-47674\nhttps://github.com/honojs/hono/commit/c831020fb1fa2e929d222f6c84e1abfe013e512b\nhttps://github.com/honojs/hono\nhttps://github.com/honojs/hono/releases/tag/v4.12.21\n","enisa_id":"EUVD-2026-32926\n","aliases":"GHSA-xrhx-7g5j-rcj5\nCVE-2026-47674\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:03 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"9a4eed61-05db-368f-8aee-1b0ab67263e9","vulnerability":{"id":"CVE-2026-47674","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule — such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses — do not match the normalized rule entry, causing the rule to be silently skipped. This vulnerability is fixed in 4.12.21.","datePublished":"May 28, 2026, 3:29:08 PM","dateUpdated":"Jun 2, 2026, 6:15:02 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-xrhx-7g5j-rcj5\n","enisa_id":"EUVD-2026-32926\n","assigner":"GitHub_M","epss":0.24,"dataProcessed":"Nov 3, 2026, 7:18:07 AM","vulnerabilityProduct":[{"id":"7f641eac-96b1-3aaf-b634-c50943657b90","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"\u003c 4.12.21"}],"vulnerabilityVendor":[{"id":"221d9e14-76e9-3290-b8ba-63a5b4666d19","vendor":{"name":"honojs"}}]}}],"enisaIdAdvisory":[]}