The vulnerability in Hono’s ipRestriction() function causes the library to fail to canonicalize IPv4-mapped IPv6 addresses such as ::ffff:127.0.0.1 before enforcing IPv4 allow or deny rules. As a result, requests that carry IPv4-mapped IPv6 IPs can bypass intended restrictions, allowing unauthorized access to protected resources. The weakness is a configuration error that leads to improper access control, identified as CWE-180.

The affected product is the Hono.js framework (hono) used in JavaScript runtime environments. All installations running any version prior to 4.12.12 are vulnerable, particularly those operating in Node.js dual‑stack mode where IPv4‑mapped IPv6 addresses are present.

The CVSS score of 6.3 indicates moderate severity. EPSS data is not provided, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, involving network traffic directed at a web application that employs ipRestriction() with typical allow/deny rules. An attacker simply needs to craft HTTP requests that present IPv4‑mapped IPv6 client addresses; no authentication or privileged local access is required. If the environment uses dual‑stack networking, the failure to canonicalize these addresses can be exploited by any external actor who can reach the application endpoint.