CVE-2026-47674 is an incorrect regular expression and normalization issue (CWE-185) in the ip-restriction middleware of the honojs hono framework before version 4.12.21. The middleware attempts to enforce IP allow and deny rules by comparing incoming IP addresses to static rules using string equality after partial normalization. However, non-canonical IPv6 representations—such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses—do not match the normalized rule entries, causing the middleware to skip the intended IP restriction silently. This can lead to unauthorized IP addresses bypassing access controls. The issue is resolved in hono version 4.12.21.

The vulnerability allows an attacker to bypass IP-based access control restrictions by using non-canonical IPv6 address representations that are not correctly matched by the middleware. This results in the ip-restriction middleware silently skipping deny or allow rules, potentially permitting unauthorized access. There is no impact on confidentiality or availability reported, only integrity of access control is affected. No known exploits are reported in the wild.

Upgrade the honojs hono framework to version 4.12.21 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in 4.12.21, applying this official update fully mitigates the issue. No other mitigation steps are indicated.