Read the docs
TI-2026-39189 Aliases CVE-2026-54289GHSA-wgpf-jwqj-8h8p

Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

Priority MEDIUM 55CWE-348Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request middleware sees only the last value of a repeated header instead of the full chain. For applications that base access control on the X-Forwarded-For chain, this can weaken or alter that decision; for auditing, hop history is lost. This vulnerability is fixed in 4.12.25.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00178 7th percentileScored 2026-11-07
Fix Fixed hono (honojs): 4.12.25hono (npm): 4.12.25

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
honojshonobefore 4.12.254.12.25Patch availableCNA
—hono (npm)before 4.12.254.12.25Patch availableGHSA-wgpf-jwqj-8h8p
  • hono Vendorhonojs Affected before 4.12.25 Fixed in 4.12.25 Patch available CNA
  • hono (npm) Vendor— Affected before 4.12.25 Fixed in 4.12.25 Patch available GHSA-wgpf-jwqj-8h8p

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:hono:hono:*:*:*:*:*:*:*:*——honojs
  • cpe:2.3:a:hono:hono:*:*:*:*:*:*:*:* Versions — — ·honojs

Remediation

  • Fix · CNA hono (honojs) Fixed in 4.12.25
  • Fix · GHSA-wgpf-jwqj-8h8p hono (npm) Fixed in 4.12.25 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54289
  2. 2026-10-03 Alias added: GHSA-wgpf-jwqj-8h8p

References

Advisory 1

Other 2

  • TI-2024-21741 Hono vulnerable to Restricted Directory Traversal in serveStatic with deno CVSS 3.1MEDIUM 5.3
  • TI-2024-15441 @hono/node-server can't handle "double dots" in URL CVSS 3.1MEDIUM 5.3
  • TI-2024-32610 Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header. CVSS 3.1MEDIUM 5.9
  • TI-2024-29381 Hono CSRF middleware can be bypassed using crafted Content-Type header CVSS 3.1MEDIUM 5.0
  • TI-2026-23190 Hono: Arbitrary file access via serveStatic vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-22076 Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo CVSS 3.1HIGH 8.2
See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences