Web Application Framework Vulnerability in Hono by Honojs

CVE-2026-54289

What is CVE-2026-54289?

The Hono web application framework for JavaScript runtimes suffered from an issue where repeated request headers delivered by CloudFront on AWS Lambda@Edge were not properly handled. Instead of appending multiple values appropriately, the adapter inadvertently overwrote each value due to incorrect use of Headers.set in place of Headers.append. As a result, critical headers like X-Forwarded-For, Forwarded, and Via were truncated to a single value, which impairs the ability of request middleware to access the complete header chain. This mismanagement can undermine access control mechanisms relying on the full X-Forwarded-For history and may adversely affect auditing processes. Users are encouraged to update to version 4.12.25 or later to mitigate this issue.

References