Description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, IP Restriction Middleware in Hono is vulnerable to an IP address validation bypass. The `IPV4_REGEX` pattern and `convertIPv4ToBinary` function in `src/utils/ipaddr.ts` do not properly validate that IPv4 octet values are within the valid range of 0-255, allowing attackers to craft malformed IP addresses that bypass IP-based access controls. Version 4.11.7 contains a patch for the issue.

INFO

Published Date :

2026-01-27T19:06:42.792Z

Last Modified :

2026-01-27T19:20:35.594Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-24398 vulnerability.

Vendors Products
Hono
  • Hono
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-24398.

URL Resource
https://github.com/honojs/hono/commit/edbf6eea8e6c26a3937518d4ed91d8666edeec37 cve-icon cve-icon
https://github.com/honojs/hono/releases/tag/v4.11.7 cve-icon cve-icon
https://github.com/honojs/hono/security/advisories/GHSA-r354-f388-2fhh cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact