CVE-2026-39409

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, ipRestriction() does not canonicalize IPv4-mapped IPv6 client addresses (e.g. ::ffff:127.0.0.1) before applying IPv4 allow or deny rules. In environments such as Node.js dual-stack, this can cause IPv4 rules to fail to match, leading to unintended authorization behavior. This vulnerability is fixed in 4.12.12.

• CWE-180

• https://github.com/honojs/hono/commit/48fa2233bc092f650119f42df043050737cabf39Patch
• https://github.com/honojs/hono/releases/tag/v4.12.12Release Notes
• https://github.com/honojs/hono/security/advisories/GHSA-xpcf-pg52-r92gVendor Advisory

Published

Apr 8, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39401Cronicle is a multi-server task scheduler and runner, with a…5.4
• CVE-2026-39402lxc is a Linux container runtime. In the setuid helper lxc-u…6.5
• CVE-2026-39405Frappe Learning Management System (LMS) is a learning system…9.4
• CVE-2026-39406@hono/node-server allows running the Hono application on Nod…5.3
• CVE-2026-39407Hono is a Web application framework that provides support fo…5.3
• CVE-2026-39408Hono is a Web application framework that provides support fo…7.5
• CVE-2026-3941Insufficient policy enforcement in DevTools in Google Chrome…4.3
• CVE-2026-39410Hono is a Web application framework that provides support fo…4.8
• CVE-2026-39411LobeHub is a work-and-lifestyle space to find, build, and co…7.1
• CVE-2026-39412LiquidJS is a Shopify / GitHub Pages compatible template eng…7.5
• CVE-2026-39413LightRAG provides simple and fast retrieval-augmented genera…6.5
• CVE-2026-39414MinIO is a high-performance object storage system. From RELE…6.5