CVE-2026-24398Disclosure(hono / hono)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, IP Restriction Middleware in Hono is vulnerable to an IP address validation bypass. The `IPV4_REGEX` pattern and `convertIPv4ToBinary` function in `src/utils/ipaddr.ts` do not properly validate that IPv4 octet values are within the valid range of 0-255, allowing attackers to craft malformed IP addresses that bypass IP-based access controls. Version 4.11.7 contains a patch for the issue.

hono CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/honojs/hono/commit/edbf6eea8e6c26a3937518d4ed91d8666edeec37

Vendor / third-party advisories

https://github.com/honojs/hono/security/advisories/GHSA-r354-f388-2fhh

Other references

https://github.com/honojs/hono/releases/tag/v4.11.7

Weakness type (CWE)

CWE-185

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

hono

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-01-27); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

hono

Products

hono

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-01-27	2	Disclosure2
2026-01-28	1	Disclosure1

Full discourse3 posts

cvereports@_cvereports254d
Disclosure
CVE-2026-24398: Hono IP Spoofing: When 255 + 100 Equals Access A logic flaw in Hono's IP address validation middleware allows attackers to bypass IP-based access controls by supplying malformed IPv4 addresses that trigger an integer overflow during bi... https://cvereports.com/reports/CVE-2026-24398
Post summary
The report discloses a logic flaw in Hono’s IP address validation that permits IP spoofing through integer overflow, with no evidence of exploitation or mitigation steps.
0000060
29 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds254d
Disclosure
CVE-2026-24398 IP Address Validation Bypass in Hono Web Framework Before 4.11.7 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-24398
Post summary
The text announces CVE‑2026‑24398, describing an IP address validation bypass vulnerability in Hono Web Framework versions prior to 4.11.7, with no PoC, exploit, patch, or exploitation evidence provided.
0000063
4.0K followersView on X
CVE@CVEnew254d
Disclosure
CVE-2026-24398 Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, IP Restriction Middleware in Hono is vulnerable to an I… https://www.cve.org/CVERecord?id=CVE-2026-24398
Post summary
The tweet announces CVE‑2026‑24398 as a flaw in Hono’s IP Restriction Middleware, noting a potential fix in version 4.11.7 but providing no PoC, exploit code, or active exploitation details.
00000175
56.5K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	hono	hono	-	node.js	-

Explore more

Back to dashboard hono CVEs hono vulnerabilities