The honojs hono framework's ip-restriction middleware prior to version 4.12.21 performs IP address comparisons using string equality after partial normalization. This approach fails to correctly handle non-canonical IPv6 address representations such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses. As a result, IP addresses that should be matched by static deny or allow rules may be bypassed because their non-canonical forms do not match the normalized rule entries. This vulnerability is identified as CWE-185 (Incorrect Regular Expression) and CWE-1289, and is addressed by updating to version 4.12.21.

The vulnerability allows an attacker to bypass IP-based access control rules configured in the ip-restriction middleware by using non-canonical IPv6 address representations. This can lead to unauthorized access if IP restrictions are relied upon for security. The CVSS score of 5.3 (medium severity) reflects the network attack vector, low complexity, no privileges required, no user interaction, and impact limited to integrity (bypassing restrictions) without confidentiality or availability impact.

A fix is available in honojs hono version 4.12.21. Users should upgrade to this version or later to ensure correct normalization and matching of IP addresses in the ip-restriction middleware. No other mitigation is indicated by the vendor advisory or data provided.