CVE-2026-47674
Hono ≤ 4.12.21
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NSummary
CVE-2026-47674 is a medium-severity Incorrect Regular Expression (CWE-185) vulnerability in Hono Hono. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 16th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-32926
Vulnerability Data
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of…
more
an address already listed in a static rule — such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses — do not match the normalized rule entry, causing the rule to be silently skipped. This vulnerability is fixed in 4.12.21.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.2.2V9.1.3V10.4.6V2.2.2
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover regex that fails to match or compare data as intended.
SI-10 requires validity checks on information inputs, directly stopping unsafe equivalence validation failures for identifiers and references.
Requiring documented development standards and tools reduces the chance that incorrect regular expressions are written into validation or filtering logic.
An SDLC that incorporates security can embed reviews or tooling that catch malformed regular expressions before deployment.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require correct regex design, testing, and review to avoid improper matching.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect regex-related flaws before release.
Secure development lifecycle includes validation of input-handling constructs such as regex.
Application security requirements can mandate correct regex design and testing.
Secure architecture principles include proper input validation and canonicalization to avoid unsafe equivalence.
Secure coding standards directly address proper construction and review of regular expressions.