CVE-2026-59897 Details
Description
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware or application logic that depends on the complete X-Forwarded-For chain, rate limiting, audit logging, or proxy-chain validation can receive incomplete data. This issue is fixed in version 4.12.27.
A vulnerability exists in the Hono web application framework, specifically in versions 4.3.3 prior to 4.12.27, within the AWS API Gateway v1 adapter. This vulnerability arises because the adapter improperly de-duplicates repeated request header values by using a substring comparison, rather than an exact match. As a result, distinct values can be lost, particularly in headers like 'X-Forwarded-For' that are crucial for IP tracking, rate limiting, audit logging, or proxy validation. The issue also affects the VPC Lattice adapter.
Upgrade to Hono version 4.12.27, which addresses the header de-duplication issue by ensuring exact matches are used.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-348 | Use of Less Trusted Source | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hono hono | >= 4.3.3, < 4.12.27 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | Initial Analysis | [email protected] |
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |