6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-39409

CVE-2026-39409: Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, ipRestriction() does not canonicalize IPv4-mapped IPv6 client addresses (e.g. ::ffff:127.0.0.1) before applying IPv4 allow or deny rules. In environments such as Node.js dual-stack, this can cause IPv4 rules to fail to match, leading to unintended authorization behavior. This vulnerability is fixed in 4.12.12.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-39409

CVE-2026-39409:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hono	npm	< 4.12.12	4.12.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the ipRestriction middleware, specifically within the logic created by the buildMatcher function. The root cause is the failure to canonicalize IPv4-mapped IPv6 addresses (e.g., ::ffff:192.168.1.1) to their standard IPv4 representation before matching them against user-defined IP rules.

Before the patch, the matching logic would treat an address like ::ffff:127.0.0.1 as a true IPv6 address because it contains colons. Consequently, it would not be compared against IPv4 rules in the allowList or denyList. For example, a CIDR rule check included if (isIPv4 !== remote.isIPv4) { continue }, which would cause an IPv4 rule to be skipped for an IPv4-mapped IPv6 address, allowing the request to bypass the restriction.

The patch addresses this by:

Introducing helper functions isIPv4MappedIPv6 and convertIPv4MappedIPv6ToIPv4 to detect and convert these special addresses.
Modifying the buildMatcher function to create a new matching function that canonicalizes the incoming remote IP address. If it's an IPv4-mapped IPv6 address, it's converted to its IPv4 equivalent before being checked against the rules.
For static IP rules, the patch now adds both the plain IPv4 address and its IPv4-mapped (::ffff:) equivalent to the set of rules to ensure a match regardless of how the address is represented.

The vulnerable functions are ipRestriction (the public API) and the internal buildMatcher function, which contains the flawed logic for generating the IP address matcher. An attacker could exploit this by sending requests from an IP address that is on a deny list, but the request's source IP is represented as an IPv4-mapped IPv6 address, bypassing the check.

Vulnerable functions

ipRestriction

src/middleware/ip-restriction/index.ts

This is the main exported middleware function that users configure with IP allow/deny lists. It is considered vulnerable because it produces a request handler with flawed IP matching logic. Before the patch, the handler it created would not canonicalize IPv4-mapped IPv6 addresses (e.g., `::ffff:127.0.0.1`) to their IPv4 form. As a result, an IPv4 rule (e.g., `127.0.0.1`) would fail to match, allowing an attacker to bypass IP-based access restrictions.

buildMatcher

src/middleware/ip-restriction/index.ts

This internal function is responsible for parsing the IP rules and returning the actual matching function. The vulnerability is directly within the logic it generates. The original logic strictly checked if the rule type (IPv4/IPv6) matched the remote address type, failing to account for IPv4-mapped IPv6 addresses. This caused IPv4 rules to be skipped for such addresses. The patch replaces this strict check with logic that canonicalizes the address before comparison.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.