CVE-2026-54289

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request middleware sees only the last value of a repeated header instead of the full chain. For applications that base access control on the X-Forwarded-For chain, this can weaken or alter that decision; for auditing, hop history is lost. This vulnerability is fixed in 4.12.25.

• CWE-348

• https://github.com/honojs/hono/security/advisories/GHSA-wgpf-jwqj-8h8p
• https://github.com/honojs/hono/security/advisories/GHSA-wgpf-jwqj-8h8p

Published

Jun 22, 2026

Last Modified

Jun 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54282Starlette is a lightweight ASGI framework/toolkit. Prior to …5.3
• CVE-2026-54283Starlette is a lightweight ASGI framework/toolkit. From 0.4.…7.5
• CVE-2026-54285opentelemetry-js is the OpenTelemetry JavaScript Client. Pri…5.3
• CVE-2026-54286Hono is a Web application framework that provides support fo…5.9
• CVE-2026-54287Hono is a Web application framework that provides support fo…5.3
• CVE-2026-54288Hono is a Web application framework that provides support fo…6.5
• CVE-2026-5429Unsanitized input during web page generation in the Kiro Age…7.8
• CVE-2026-54290Hono is a Web application framework that provides support fo…7.1
• CVE-2026-54291pgjdbc is an open source postgresql JDBC Driver. In releases…5.9
• CVE-2026-54292Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-54293NLTK (Natural Language Toolkit) is a suite of open source Py…7.5
• CVE-2026-54294Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…