CVE-2026-39409 Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses
Attackers can bypass IP restrictions in Hono applications by using IPv4-mapped IPv6 addresses, potentially gaining unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-39409?
CVE-2026-39409 is a medium-severity authentication bypass vulnerability in honojs hono, published on 8 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, ipRestriction() does not canonicalize IPv4-mapped IPv6 client addresses (e.g. ::ffff:127.0.0.1) before applying IPv4 allow or deny rules. In environments such as Node.js dual-stack, this can cause IPv4 rules to fail to match, leading to unintended authorization behavior. This vulnerability is fixed in 4.12.12.
Weakness: CWE-180
Which versions are affected by CVE-2026-39409?
2 open source packages ship an affected version, including hono. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
hono npm | All versions | 4.12.12 |
hono npm | All versions | 4.12.12 |
Products include Hono Hono.
How do I fix CVE-2026-39409?
Upgrade hono to 4.12.12 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-39409 being exploited?
There is no known exploitation of CVE-2026-39409 in the wild and no public exploit code.
Other vulnerabilities in honojs hono
- CVE-2026-27700 Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
- CVE-2026-22817 JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass
- CVE-2026-22818 JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)
- CVE-2025-62610 Hono Improperly Authorizes JWT Audience Validation
- CVE-2026-29045 Hono: Arbitrary file access via serveStatic vulnerability
Sources
Also known as CLEANSTART-2026-SE49941, CLEANSTART-2026-YO53266, GHSA-xpcf-pg52-r92g, MINI-82fr-77jf-whmg, MINI-937m-6mf6-v3cp, MINI-gfwv-jm4c-7wr2 and 5 more.