🛡️ CVE-2026-59897 — hono

🟡 CVSS 4.8 — Medium ✅ No Known Exploit CWE-348 OSV

4.8

CVSS Score

0 Low4 Medium7 High9 Critical10

Description

Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

Summary

The AWS API Gateway v1 adapter can drop a distinct repeated request header value. When a header appears multiple times, the adapter de-duplicates values using a substring comparison instead of an exact match, so a value that is a substring of another value of the same header is omitted (for example, 203.0.113.1 is dropped when another value is 203.0.113.10).

Details

A repeated request header carries an ordered list of values. Middleware or application logic that depends on the complete list — such as IP restriction that walks the X-Forwarded-For chain, rate limiting, audit logging, or proxy-chain validation — can therefore receive incomplete data that differs from what the client actually sent.

This issue arises on deployments using the AWS API Gateway v1 adapter (the same pattern also affects the VPC Lattice adapter), for requests that contain the same header more than once.

Impact

An attacker can craft repeated header values so that one value is omitted before the application sees the request. Where a security or routing decision relies on the full chain, this can alter that decision.

This affects applications deployed through Hono's AWS API Gateway v1 (or VPC Lattice) adapter that rely on the complete set of repeated request header values.

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is high, an attacker needs no privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality low, integrity low, availability none.

Affected software

CVE-2026-59897 is recorded against 1 package.

hono

Timeline and source

Published on 21 July 2026 and last revised on 23 July 2026. No public exploit is currently recorded for this entry. A vendor advisory or fix has been published. Record sourced from OSV.

References

github.com (Web)
nvd.nist.gov (Advisory)
github.com (Web)
github.com (Package)
github.com (Web)

Details

Severity MEDIUM

CVSS Score 4.8

CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE CWE-348

Public Exploit ✅ No

Source OSV

Published 2026-07-21

Updated 2026-08-12

Modified 2026-07-23

Fix URL https://github.com/honojs/hono/commit/aa921770d09bc35970362d5a2630a878f6d982fd

Affected Packages

Software	From version	Fixed in
hono	—	—

References

WEB https://github.com/honojs/hono/security/advisories/GHSA-xgm2-5f3f-mvvc

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-59897

WEB https://github.com/honojs/hono/commit/aa921770d09bc35970362d5a2630a878f6d982fd

PACKAGE https://github.com/honojs/hono

WEB https://github.com/honojs/hono/releases/tag/v4.12.27

🔗 NVD 🔗 Mitre ✅ Fix / Advisory

Similar Threats

More CVE 2026 advisories

Browse all of CVE 2026 in the advisory index.

Vulnerability Monitoring

Track new vulnerabilities in hono

CVE-2026-59897 is rated CVSS 4.8 Medium. BotEraser monitors your WordPress installation and notifies you when software you use appears in our vulnerability database.

Set Up Free Alerts →

No credit card required · Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.