Incorrect Behavior Order: Validate Before Canonicalize Affecting openclaw package, versions <2026.4.9-r0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-MINIMOSLATEST-OPENCLAW-15993822
- published12 Apr 2026
- disclosed8 Apr 2026
Introduced: 8 Apr 2026
NewCVE-2026-39409 (opens in a new tab)How to fix?
Upgrade Minimos:latest openclaw to version 2026.4.9-r0 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream openclaw package and not the openclaw package as distributed by Minimos.
See How to fix? for Minimos:latest relevant fixed versions and status.
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, ipRestriction() does not canonicalize IPv4-mapped IPv6 client addresses (e.g. ::ffff:127.0.0.1) before applying IPv4 allow or deny rules. In environments such as Node.js dual-stack, this can cause IPv4 rules to fail to match, leading to unintended authorization behavior. This vulnerability is fixed in 4.12.12.
References
- https://www.cve.org/CVERecord?id=CVE-2026-39409
- https://github.com/advisories/GHSA-xpcf-pg52-r92g
- https://osv.dev/vulnerability/MINI-wmxc-6f9j-ww8p
- https://osv.dev/vulnerability/CVE-2026-39409
- https://github.com/honojs/hono/commit/48fa2233bc092f650119f42df043050737cabf39
- https://github.com/honojs/hono/releases/tag/v4.12.12
- https://github.com/honojs/hono/security/advisories/GHSA-xpcf-pg52-r92g