Hono Framework EUVD-2026-42325

Exploitation requires that the application is deployed on AWS Lambda behind an AWS API Gateway v1 (REST API) endpoint - not API Gateway v2 (HTTP API). The Hono AWS API Gateway v1 adapter must be actively used as the runtime adapter. The security impact only materializes when middleware or application logic downstream of the adapter relies on the completeness or distinctness of repeated request header values such as X-Forwarded-For for rate limiting, audit logging, IP allowlisting, or proxy-chain validation. The attacker must control or influence the values of repeated headers in the incoming request, which typically means the attacker is either the direct client or able to inject headers through an upstream proxy. Exploitation is limited by AC:H - the crafted values must satisfy the substring overlap condition, which requires knowledge of existing header values in the chain. No authentication is required (PR:N). Applications not using security controls that depend on complete repeated header values are not at meaningful risk even if running the affected version.

The NVD CVSS 3.1 score of 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) accurately reflects a medium-severity, network-accessible issue with elevated attack complexity. AC:H is appropriate because the attacker must craft request headers where one IP or token value is a substring of another, which requires knowing or guessing values already in the chain - a non-trivial precondition. The impact is indirect: no direct data exfiltration or command execution, but integrity (I:L) and confidentiality (C:L) are plausible via bypass of IP-based rate limiting, audit log tampering, or proxy-trust circumvention. No EPSS data was provided in the input, so exploitation probability cannot be quantitatively assessed. No KEV listing exists, and no POC code has been identified at time of analysis. The realistic risk priority is moderate and context-dependent: organizations using Hono with the AWS API Gateway v1 adapter in security-sensitive workflows (rate limiting, fraud detection, audit compliance) should treat this as a priority patch; those using the v2 adapter or not relying on header-based security controls face minimal practical risk.

An attacker sends a crafted HTTP request through an AWS API Gateway v1 endpoint with X-Forwarded-For values engineered so that one IP address is a substring of another (for example, '192.168.1.1' alongside '192.168.1.10'). The Hono adapter's substring de-duplication silently drops one entry, causing an upstream rate-limiting middleware to see a shorter chain and potentially misidentify the originating IP, allowing the attacker to exceed rate limits or evade IP-based blocklisting. No public POC has been identified, but the logic flaw is straightforward enough to reproduce from the advisory description alone.