CVE-2026-59897

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware or application logic that depends on the complete X-Forwarded-For chain, rate limiting, audit logging, or proxy-chain validation can receive incomplete data. This issue is fixed in version 4.12.27.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/honojs/hono/commit/aa921770d09bc35970362d5a2630a878f6d982fd	Patch
https://github.com/honojs/hono/releases/tag/v4.12.27	Release Notes
https://github.com/honojs/hono/security/advisories/GHSA-xgm2-5f3f-mvvc	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hono:hono:*:*:*:*:*:node.js:*:*

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Hono es un framework de aplicación web que proporciona soporte para cualquier entorno de ejecución de JavaScript. Desde la 4.3.3 antes de la 4.12.27, el adaptador de AWS API Gateway v1 puede descartar un valor de encabezado de solicitud repetido distinto porque desduplica valores usando una comparación de subcadena en lugar de una coincidencia exacta, por lo que el middleware o la lógica de la aplicación que depende de la cadena completa de X-Forwarded-For, la limitación de velocidad, el registro de auditoría o la validación de la cadena de proxy puede recibir datos incompletos. Este problema se ha corregido en la versión 4.12.27.

Information

Published : 2026-07-08 17:17

Updated : 2026-10-25 17:10

NVD link : CVE-2026-59897

Mitre link : CVE-2026-59897

CVE.ORG link : CVE-2026-59897

JSON object : View

Products Affected

hono

hono

CWE

CWE-348

Use of Less Trusted Source

{"id": "CVE-2026-59897", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59897", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T13:51:23.283182Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "honojs", "product": "hono", "versions": [{"status": "affected", "version": ">= 4.3.3, < 4.12.27"}]}]}], "published": "2026-07-08T17:17:27.637", "references": [{"url": "https://github.com/honojs/hono/commit/aa921770d09bc35970362d5a2630a878f6d982fd", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/honojs/hono/releases/tag/v4.12.27", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/honojs/hono/security/advisories/GHSA-xgm2-5f3f-mvvc", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-348"}]}], "descriptions": [{"lang": "en", "value": "Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware or application logic that depends on the complete X-Forwarded-For chain, rate limiting, audit logging, or proxy-chain validation can receive incomplete data. This issue is fixed in version 4.12.27."}, {"lang": "es", "value": "Hono es un framework de aplicaci\u00f3n web que proporciona soporte para cualquier entorno de ejecuci\u00f3n de JavaScript. Desde la 4.3.3 antes de la 4.12.27, el adaptador de AWS API Gateway v1 puede descartar un valor de encabezado de solicitud repetido distinto porque desduplica valores usando una comparaci\u00f3n de subcadena en lugar de una coincidencia exacta, por lo que el middleware o la l\u00f3gica de la aplicaci\u00f3n que depende de la cadena completa de X-Forwarded-For, la limitaci\u00f3n de velocidad, el registro de auditor\u00eda o la validaci\u00f3n de la cadena de proxy puede recibir datos incompletos. Este problema se ha corregido en la versi\u00f3n 4.12.27."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hono:hono:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "3B34D77B-60D8-4235-8A45-055C0B65B608", "versionEndExcluding": "4.12.27", "versionStartIncluding": "4.3.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}