EUVD-2026-42325
GHSA-xgm2-5f3f-mvvc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable via API Gateway (AV:N) but requires crafted substring-overlapping header values and v1 adapter deployment (AC:H); no auth needed; limited C/I via security-control bypass; no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
3Blast Radius
ecosystem impact- 1 npm packages depend on hono (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 4.3.3.
DescriptionNVD
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware or application logic that depends on the complete X-Forwarded-For chain, rate limiting, audit logging, or proxy-chain validation can receive incomplete data. This issue is fixed in version 4.12.27.
AnalysisAI
Header de-duplication logic in Hono's AWS API Gateway v1 adapter silently drops distinct repeated header values because it uses substring comparison rather than exact string equality, meaning a value like '10.0.0.1' would incorrectly suppress '10.0.0.10'. Middleware or application logic relying on a complete X-Forwarded-For chain, rate limiting counters, audit trail integrity, or proxy-chain trust validation receives a truncated view of the request. Affected versions span 4.3.3 through 4.12.26; no public exploit identified at time of analysis, though the GitHub advisory confirms the issue and a fix is released in v4.12.27.
Technical ContextAI
Hono (honojs/hono, CPE cpe:2.3:a:honojs:hono:*:*:*:*:*:*:*:*) is a lightweight, multi-runtime JavaScript web framework used across Cloudflare Workers, Deno, Bun, Node.js, and AWS Lambda runtimes. The AWS API Gateway v1 adapter is responsible for translating API Gateway event payloads - where multi-value headers are represented as arrays - into standard HTTP request objects. The de-duplication step that collapses repeated header values is implemented using substring matching (e.g., String.includes or equivalent) rather than strict equality, violating the RFC 7230 requirement that multi-value header fields be treated as distinct comma-separated entries. CWE-348 (Use of Less Trusted Source) captures the root cause: the adapter effectively discards legitimate header data, causing downstream logic to operate on a less complete - and therefore less trustworthy - representation of the original request. The affected code path is specific to the v1 (REST API) adapter; whether the v2 (HTTP API) adapter shares this logic is not confirmed from available data.
RemediationAI
Vendor-released patch: v4.12.27. Upgrade to Hono v4.12.27 or later using your package manager (e.g., npm install hono@4.12.27 or equivalent). The fix is confirmed via the GitHub release at https://github.com/honojs/hono/releases/tag/v4.12.27 and the underlying commit at https://github.com/honojs/hono/commit/aa921770d09bc35970362d5a2630a878f6d982fd. If an immediate upgrade is not feasible, a compensating control is to move header-dependent security logic (rate limiting, IP allowlisting, audit logging) upstream into the AWS API Gateway itself using request validators, WAF rules, or Lambda authorizers - this avoids dependence on the adapter's header normalization. Note that this workaround adds operational complexity and does not fix the underlying data integrity issue. Applications that do not use the AWS API Gateway v1 adapter or do not rely on repeated header value completeness for security decisions are not at meaningful risk and can defer patching to their normal cycle.
The adapter @hono/node-server allows you to run your Hono application on Node.js. Rated high severity (CVSS 7.5), this v
Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery (CSRF) middleware by
Quadratic-complexity denial of service in Hono's `languageDetector` middleware (versions 4.12.0-4.12.33) allows unauthen
Hono is a Web application framework that provides support for any JavaScript runtime. Rated medium severity (CVSS 5.3),
@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Rated medium severity (CVSS 5.3),
Hono is a Web application framework that provides support for any JavaScript runtime. Rated medium severity (CVSS 5.0),
Cross-user HTML disclosure in Hono's server-side rendering affects all applications using hono/jsx with memo()-wrapped c
Hono is a web framework written in TypeScript. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploita
Hono is a Web application framework that provides support for any JavaScript runtime. [CVSS 8.2 HIGH]
Hono versions before 4.11.4 allow JWT algorithm confusion attacks through improper algorithm validation in the JWK/JWKS
Hono before version 4.11.4 contains a JWT algorithm confusion vulnerability in its JWK/JWKS verification middleware that
Hono's `proxy()` function in the `hono/proxy` Proxy Helper leaks connection-scoped response headers to downstream client
Same weakness CWE-348 – Use of Less Trusted Source
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today