5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47674

CVE-2026-47674: Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule — such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses — do not match the normalized rule entry, causing the rule to be silently skipped. This vulnerability is fixed in 4.12.21.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47674

CVE-2026-47674:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hono	npm	< 4.12.21	4.12.21

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-47674, exists in the ip-restriction middleware of the Hono framework. The root cause was the use of string comparison to check if an incoming IP address matched a static deny or allow rule. IPv6 has multiple valid string representations (canonical, compressed, IPv4-mapped, etc.) for the same address. The middleware would store the rules in a canonical form, but would not normalize the incoming IP address from a request before the comparison. This discrepancy allowed an attacker to bypass a deny rule by sending the IP in a non-canonical form.

The patch addresses this by shifting from string-based comparison to a numerical one. It introduces new utility functions in src/utils/ipaddr.ts (convertIPv4ToBinary, convertIPv6ToBinary) that parse and convert IP addresses into a canonical bigint representation, rejecting any invalid formats. The core middleware logic in src/middleware/ip-restriction/index.ts was updated to use these functions. Now, both the configured IP rules and the incoming remote IP address are converted to their binary bigint form before being compared. This ensures that different string representations of the same IP address are correctly matched, closing the bypass vulnerability. The primary vulnerable function is ipRestriction, as it contains the flawed checking logic.

Vulnerable functions

ipRestriction

src/middleware/ip-restriction/index.ts

The `ipRestriction` middleware was vulnerable to a bypass of its static IP deny rules. It compared the incoming request's IP address against the configured rules using direct string equality. An attacker could provide a non-canonical representation of a denied IPv6 address (e.g., `2001:db8::1` instead of the canonical `2001:0db8:0000:0000:0000:0000:0000:0001` or other variations). Because the string representations did not match, the deny rule was not triggered, allowing the request to bypass the access control.

convertIPv6ToBinary

src/utils/ipaddr.ts

This function is responsible for converting an IPv6 string into its binary representation. The original implementation was too permissive and did not correctly or consistently normalize various non-canonical IPv6 address formats. The rewrite ensures that any valid representation of an IPv6 address is converted to a single, canonical binary value, which is essential for the corrected numerical comparison logic in the `ipRestriction` middleware. It also now properly rejects invalid IP address strings.

convertIPv4ToBinary

src/utils/ipaddr.ts

This function, which converts an IPv4 string to its binary representation, was made more strict to prevent invalid IP address formats from being processed. While not the primary cause of the bypass vulnerability, its previous leniency could lead to unexpected behavior when processing malformed IP addresses. The fix contributes to the overall security hardening of the IP restriction feature.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.