4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24398

CVE-2026-24398: Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, IP Restriction Middleware in Hono is vulnerable to an IP address validation bypass. The IPV4_REGEX pattern and convertIPv4ToBinary function in src/utils/ipaddr.ts do not properly validate that IPv4 octet values are within the valid range of 0-255, allowing attackers to craft malformed IP addresses that bypass IP-based access controls. Version 4.11.7 contains a patch for the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24398

CVE-2026-24398:

4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hono	npm	< 4.11.7	4.11.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in Hono's IP Restriction Middleware and is caused by improper validation of IPv4 addresses. The analysis of the patch and vulnerability description reveals a two-stage flaw.

First, the distinctRemoteAddr function in src/utils/ipaddr.ts used a weak regular expression (/^[0-9]{0,3}\\.{[0-9]{0,3}}\\.{[0-9]{0,3}}\\.{[0-9]{0,3}}$/) that allowed octets with values greater than 255. The commit edbf6eea8e6c26a3937518d4ed91d8666edeec37 rectifies this by introducing a stricter regex that correctly enforces the 0-255 range for each octet. This function acts as the gateway for the vulnerability, incorrectly flagging malformed IPs as valid.

Second, the convertIPv4ToBinary function, as stated in the CVE description, does not validate its input. It trusts that the IP address it receives is valid. When a malformed IP (e.g., 1.2.2.355) is passed from distinctRemoteAddr, the bitwise calculations in convertIPv4ToBinary overflow, causing the IP to be treated as a different address (e.g., 1.2.3.99). This allows an attacker to bypass IP-based blocklists or allowlists.

During an exploit, a profiler would show calls to distinctRemoteAddr to validate the attacker's crafted IP address, followed by a call to convertIPv4ToBinary which would then produce the incorrect binary representation, leading to the bypass. Therefore, both functions are critical to the exploit chain.

Vulnerable functions

distinctRemoteAddr

src/utils/ipaddr.ts

The `distinctRemoteAddr` function uses a permissive regular expression (`IPV4_REGEX`) that fails to validate if each octet in an IPv4 address is within the valid 0-255 range. This allows malformed IP addresses with oversized octets (e.g., '1.2.3.999') to be incorrectly identified as valid. This is the entry point of the vulnerability, as it passes tainted data to other parts of the IP restriction middleware.

convertIPv4ToBinary

src/utils/ipaddr.ts

This function is responsible for converting a string representation of an IPv4 address into its binary form. It does not perform any validation on its input and assumes the provided IP address is well-formed. When it receives a malformed IP address from a function like `distinctRemoteAddr`, its bitwise operations on octets greater than 255 cause an overflow, mapping the malicious IP to a different, potentially permitted IP address. This allows an attacker to bypass IP-based access controls.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.