CVE-2026-24398
Medium
Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, IP Restriction Middleware in Hono is vulnerable to an IP address validation bypass. The `IPV4_REGEX` pattern and `convertIPv4ToBinary` function in `src/utils/ipaddr.ts` do not properly validate that IPv4 octet values are within the valid range of 0-255, allowing attackers to craft malformed IP addresses that bypass IP-based access controls. Version 4.11.7 contains a patch for the issue.
SeverityMedium
CVSS4.8
Exploit probability—
Product
Hono
PublishedJan 27, 2026
First seenJan 27, 2026
Weakness typeCWE-185CWE-185
How to fix
Update
- hono hono4.11.7 or later
- hono4.11.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hono hono | v < 4.11.7 | 4.11.7 |
| hononpm | v < 4.11.7 | 4.11.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.