CVE-2026-24398 is a low severity vulnerability with a CVSS score of 0.0. No known exploits currently, and patches are available.
Very low probability of exploitation
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
IP Restriction Middleware in Hono is vulnerable to an IP address validation bypass. The IPV4_REGEX pattern and convertIPv4ToBinary function in src/utils/ipaddr.ts do not properly validate that IPv4 octet values are within the valid range of 0-255, allowing attackers to craft malformed IP addresses that bypass IP-based access controls.
The vulnerability exists in two components:
IPV4_REGEX (/^[0-9]{0,3}\.[0-9]{0,3}\.[0-9]{0,3}\.[0-9]{0,3}$/) accepts octet values greater than 255 (e.g., 999).convertIPv4ToBinary function does not validate octet ranges before performing bitwise operations. When an octet exceeds 255, it overflows into adjacent octets during the bit-shift calculation.For example, the IP address 1.2.2.355 is accepted and converts to the same binary value as 1.2.3.99:
355 = 256 + 99 = 0x163(1 << 24) + (2 << 16) + (2 << 8) + 355 = 0x01020363 = 1.2.3.99An attacker can bypass IP-based restrictions by crafting malformed IP addresses:
1.2.3.0/24 is blocked, an attacker can use 1.2.2.355 (or similar) to bypass the restriction.This is exploitable when the application relies on client-provided IP addresses (e.g., X-Forwarded-For header) for access control decisions.
src/utils/ipaddr.ts: IPV4_REGEX, convertIPv4ToBinary, distinctRemoteAddrPlease cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.