The vulnerability stems from an insufficient check of IPv4 octet ranges within the IP Restriction Middleware. The regex and conversion function accept addresses with octet values outside 0–255, enabling attackers to craft malformed IPs that evade IP‑based access controls. A successful bypass permits attackers to impersonate trusted IP addresses, thereby potentially gaining unauthorized access to protected resources.

The flaw affects the Hono web application framework, particularly versions prior to 4.11.7. All deployments running older releases on any JavaScript runtime, including Node.js, are susceptible. Newly released version 4.11.7 includes the required patch.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score below 1% suggests a low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be remote, as malicious actors could send crafted requests from an arbitrary source to bypass IP restrictions. Exploitation requires an attacker’s ability to influence the IP address used in the request header or similar means.