Hono CVE-2026-47674

Exploitation requires that the target Hono application uses the hono/ip-restriction middleware with at least one IPv6 address configured in its deny or allow rule set. The attacker must control or spoof a source IPv6 address that is subject to a configured restriction rule, and must connect using a non-canonical representation of that address - specifically a compressed form, explicit-zero form, or hex-notation IPv4-mapped form - that the middleware fails to normalize before comparison. The bypass does not apply to pure IPv4 rule sets, and requires that the attacker's IPv6 address be expressible in an alternate representation not handled by the partial normalization logic. Exploitation is further limited by the context of what the IP restriction is protecting: if the restricted endpoint independently requires authentication or other access controls, bypassing the IP filter alone does not yield full access. CVSS confirms no authentication is required and no user interaction is needed (PR:N/UI:N) for the network-layer bypass itself.

The CVSS 5.3 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects a network-accessible, unauthenticated, low-complexity bypass with only low integrity impact - the attack surface is wide but the direct CVSS-scored impact is narrow. No EPSS data was provided in the input and cannot be independently quantified here. This CVE is not listed in CISA KEV, and no public exploit code has been identified at time of analysis, indicating no confirmed widespread or active exploitation. The practical real-world risk is highly context-dependent: applications using ip-restriction as a sole or primary access control mechanism on sensitive or administrative endpoints face meaningful exposure, as the bypass is trivially achieved by reformatting an IPv6 address. If protected resources have independent authentication or additional access controls, the effective impact of bypassing the IP filter is substantially reduced. The low integrity-only CVSS impact (I:L, C:N, A:N) accurately captures the narrow technical scope - no data is directly exfiltrated and no availability is disrupted - but understates risk in deployments where IP allowlisting is the primary security boundary.

An attacker whose IPv6 address has been added to a deny list in the Hono ip-restriction configuration connects to the application using a non-canonical representation of their blocked address - for example, substituting compressed notation with an explicit-zero form or using a hex-encoded IPv4-mapped IPv6 address. The middleware compares the submitted string against the partially normalized rule entry, finds no match, silently skips enforcement, and grants the attacker access to the restricted endpoint. No public exploit code is known, but the technique requires only standard knowledge of IPv6 address representation equivalence, making it trivially reproducible.