Executive brief
Hono is a web application framework used to build services on various JavaScript runtimes. In certain AWS Lambda@Edge environments, the framework incorrectly handles incoming web requests that contain multiple versions of the same header, such as those used to track a user's original IP address. This can lead to security bypasses if the application relies on those headers for access control or auditing, as it may only see the last entry instead of the full history.
Technical details
A vulnerability exists in the Hono Lambda@Edge adapter where repeated request headers are incorrectly processed. When AWS CloudFront delivers multiple instances of the same header (e.g., X-Forwarded-For), the adapter uses Headers.set() instead of Headers.append(), causing subsequent values to overwrite previous ones. This results in the application receiving only the final value in a header chain. Attackers can potentially exploit this to bypass IP-based access controls or obscure their origin during auditing. The issue is specific to Lambda@Edge deployments and does not affect the API Gateway adapter. The vulnerability is addressed in version 4.12.25.
Affected products
- honojs Hono < 4.12.25
Timeline
- 2026-06-09: advisory: GitHub advisory published by maintainers
- 2026-06-22: disclosed: CVE published to NVD