CVE-2026-39409: 
JavaScript vulnerability analysis and mitigation

CVE-2026-39409 is an incorrect IP matching vulnerability in the Hono web framework's ipRestriction() middleware, where IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1) are not canonicalized before IPv4 allow/deny rules are applied. This affects all Hono npm package versions prior to 4.12.12 running in Node.js dual-stack environments. The vulnerability was published on April 7–8, 2026, and reported by security researcher r74tech. It carries a CVSS v4.0 base score of 6.3 (Medium) and a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, Hono Security Advisory).

The root cause is classified as CWE-180 (Incorrect Behavior Order: Validate Before Canonicalize). The ipRestriction() middleware classifies client addresses based on their textual form: any address containing : is treated as IPv6, including IPv4-mapped IPv6 addresses like ::ffff:127.0.0.1. Because these addresses are not normalized to their IPv4 equivalents before rule matching, IPv4 static rules (e.g., 127.0.0.1) fail to match the raw IPv4-mapped string, and IPv4 CIDR rules (e.g., 127.0.0.0/8) are skipped entirely since the address is processed as IPv6. The fix (commit 48fa223) adds isIPv4MappedIPv6() and convertIPv4MappedIPv6ToIPv4() utility functions and updates the matching logic to canonicalize IPv4-mapped IPv6 addresses before rule evaluation (Hono Security Advisory, Fix Commit).

Successful exploitation allows an attacker whose IPv4 address is on a deny list to bypass access controls by connecting via an IPv4-mapped IPv6 address in a Node.js dual-stack environment, gaining unauthorized access to protected resources. Conversely, legitimate IPv4 clients may be incorrectly rejected when using allow lists, causing unintended denial of service for authorized users. The impact is primarily a confidentiality risk — unauthorized access to restricted endpoints — with no direct integrity or availability impact on the system itself (Github Advisory, Hono Security Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). No threat actor attribution has been reported. The EPSS score is approximately 0.013% (2nd percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the target application to be deployed in a Node.js dual-stack environment with IPv4-based ipRestriction() rules configured (Hono Security Advisory).

1. Identify target: Locate a Hono application (npm package version < 4.12.12) running on Node.js in dual-stack mode that uses ipRestriction() middleware with IPv4-based deny or allow rules.
2. Determine blocked IPv4 address: Identify an IPv4 address that is on the application's deny list (e.g., 127.0.0.1 or a CIDR range like 10.0.0.0/8).
3. Connect via IPv4-mapped IPv6: Initiate an HTTP request from the blocked IPv4 address in a way that causes Node.js to represent the client address as an IPv4-mapped IPv6 address (e.g., ::ffff:127.0.0.1). This occurs naturally in dual-stack Node.js environments without any special attacker action.
4. Bypass access control: Because the middleware compares the raw string ::ffff:127.0.0.1 against the IPv4 rule 127.0.0.1 (which does not match) and skips IPv4 CIDR evaluation, the deny rule is not applied and the request is permitted, granting access to the protected resource (Hono Security Advisory).

• Network: HTTP requests to IP-restricted endpoints originating from IPv4-mapped IPv6 addresses (e.g., ::ffff:x.x.x.x) that correspond to IPv4 addresses expected to be blocked by access control rules.
• Logs: Application or web server access logs showing successful responses (HTTP 200) to requests from ::ffff:-prefixed addresses that should have been denied (HTTP 403/401) based on configured IPv4 deny lists.
• Application Behavior: Unexpected access to restricted API routes or admin endpoints from addresses that appear in the deny list when expressed in IPv4 notation.

Upgrade the Hono npm package to version 4.12.12 or later, which includes the fix for this vulnerability (Hono Release v4.12.12, Fix Commit). If immediate patching is not possible, consider disabling IPv6 dual-stack mode on the Node.js server so that client addresses are always presented in IPv4 format, or supplement ipRestriction() rules with both IPv4 and explicit IPv4-mapped IPv6 equivalents (e.g., add both 127.0.0.1 and ::ffff:127.0.0.1 to deny lists). IBM products incorporating Hono (including IBM DevOps Solution Workbench, IBM Cloud Pak for AIOps, IBM App Connect Enterprise, IBM watsonx Orchestrate Developer Edition, and IBM Bob) have also released security bulletins addressing this issue (IBM DevOps Advisory, IBM CloudPak Advisory).

The vulnerability was disclosed by Hono maintainer yusukebe via a GitHub Security Advisory on April 7, 2026, and credited to reporter r74tech. The fix was bundled with four other security fixes in the v4.12.12 release, which received positive community engagement on GitHub (9 thumbs-up reactions). IBM subsequently issued multiple security bulletins acknowledging the impact on several of its products that bundle Hono (Hono Release v4.12.12, IBM DevOps Advisory).