CVE-2026-24398: 
JavaScript vulnerability analysis and mitigation

CVE-2026-24398 is an IPv4 address validation bypass vulnerability in Hono's IP Restriction Middleware that allows attackers to spoof IP addresses and circumvent IP-based access controls. It affects all versions of the hono npm package prior to 4.11.7, across any JavaScript runtime. The vulnerability was published on January 27, 2026, by maintainer yusukebe via a GitHub Security Advisory. It carries a CVSS v3.1 base score of 4.8 (Moderate) per the official advisory, though some sources report a higher estimate of 6.5 (Github Advisory, Hono Security Advisory).

The root cause is classified as CWE-185 (Incorrect Regular Expression). The vulnerable IPV4_REGEX pattern (/^[0-9]{0,3}\.[0-9]{0,3}\.[0-9]{0,3}\.[0-9]{0,3}$/) in src/utils/ipaddr.ts accepts octet values exceeding 255 (e.g., 999), and the convertIPv4ToBinary function performs bitwise operations without validating octet ranges, causing integer overflow into adjacent octets. For example, the malformed address 1.2.2.355 is accepted and resolves to the same binary representation as 1.2.3.99 because 355 = 256 + 99, making (1 << 24) + (2 << 16) + (2 << 8) + 355 = 0x01020363. Exploitation is most effective when the application trusts client-provided IP headers such as X-Forwarded-For for access control decisions (Github Advisory, Hono Security Advisory).

Successful exploitation allows an attacker to bypass both blocklist and allowlist IP-based access controls. An attacker on a blocked IP range can craft a malformed IP address (e.g., 1.2.2.355 instead of 1.2.3.99) to have their request incorrectly permitted, or an attacker from an unauthorized IP range may gain access to restricted resources. The impact is limited to low confidentiality and low integrity — there is no availability impact — but the severity is elevated in environments where IP-based access control is the primary security mechanism protecting sensitive endpoints (Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of this report (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.015% (4th percentile), indicating a very low probability of near-term exploitation. Exploitation requires network access and has high attack complexity, particularly because it depends on the application trusting client-controlled IP headers (Github Advisory).

1. Identify target: Locate a Hono application (version < 4.11.7) that uses IP Restriction Middleware and relies on client-provided headers (e.g., X-Forwarded-For) for IP-based access control decisions.
2. Determine blocked/allowed IP range: Through reconnaissance or error responses, identify the IP ranges used in the application's allowlist or blocklist (e.g., 1.2.3.0/24 is blocked).
3. Craft malformed IP address: Calculate a malformed IPv4 address whose last octet exceeds 255 such that it overflows to match a permitted IP. For example, to appear as 1.2.3.99 while being on a different subnet, use 1.2.2.355 (since 355 = 256 + 99, the binary conversion overflows to 1.2.3.99).
4. Send spoofed request: Submit an HTTP request to the target endpoint with the crafted IP in the X-Forwarded-For header: X-Forwarded-For: 1.2.2.355.
5. Bypass access control: The vulnerable IPV4_REGEX accepts the malformed address, and convertIPv4ToBinary converts it to the binary value of the permitted IP, causing the middleware to incorrectly allow or deny the request, granting unauthorized access to restricted resources (Hono Security Advisory).

• Network: HTTP requests to IP-restricted endpoints containing X-Forwarded-For or similar headers with malformed IPv4 addresses where any octet value exceeds 255 (e.g., 1.2.2.355, 256.0.0.1, 999.999.999.999).
• Logs: Application access logs showing requests from IP addresses with out-of-range octets (values > 255) that were granted access to restricted routes; unexpected access to endpoints that should be blocked for the originating IP range.
• Application Behavior: Successful requests to IP-restricted endpoints from IP addresses that should be blocked according to the configured allowlist or blocklist rules.

The primary remediation is to upgrade the hono npm package to version 4.11.7 or later, which replaces the permissive IPV4_REGEX with a strict pattern that enforces valid octet ranges (0–255) (Hono Release v4.11.7, Patch Commit). As a workaround, avoid relying solely on client-provided IP headers (e.g., X-Forwarded-For) for access control; instead, validate and trust IP information only from known, trusted proxies. Implementing additional authentication or authorization layers beyond IP-based restrictions is recommended as a defense-in-depth measure. IBM has also released patches for affected watsonx Orchestrate products (IBM Advisory 1, IBM Advisory 2).

The vulnerability was reported by security researcher devanshbatham and promptly patched by the Hono maintainer yusukebe on January 27, 2026, as part of a broader security release (v4.11.7) that addressed multiple vulnerabilities (Hono Release v4.11.7). A threat intelligence write-up titled "How to Hack and Secure a Hono.js Server: The Critical IP Spoofing Flaw You Can't Ignore" was published shortly after disclosure, indicating community interest in the practical exploitation scenario (Feedly). The release notes explicitly recommend upgrading for users of IP Restriction Middleware, Cache Middleware, Serve Static Middleware, and the ErrorBoundary component.