CVE-2026-47674: hono Incorrect Regular Expression

Vulnerability summary

CVE-2026-47674 is a medium (CVSS 5.3) Incorrect Regular Expression vulnerability in hono. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.4% of scored vulnerabilities.

Timeline

1. 28-05-2026
   PublishedVulnerability first disclosed.
2. 02-06-2026
   Last modifiedVulnerability information updated.

Description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule — such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses — do not match the normalized rule entry, causing the rule to be silently skipped. This vulnerability is fixed in 4.12.21.

• CWE-185Incorrect Regular ExpressionThe product specifies a regular expression in a way that causes data to be improperly matched or compared.
• CWE-1289Improper Validation of Unsafe Equivalence in InputThe product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.