honojs hono up to 4.12.24 X-Forwarded-For Headers.set less trusted source

Summaryinfo

A vulnerability, which was classified as problematic, has been found in honojs hono up to 4.12.24. Affected by this vulnerability is the function Headers.set of the component X-Forwarded-For Handler. The manipulation leads to less trusted source. This vulnerability is traded as CVE-2026-54289. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in honojs hono up to 4.12.24. It has been rated as problematic. This issue affects the function Headers.set of the component X-Forwarded-For Handler. The manipulation with an unknown input leads to a less trusted source vulnerability. Using CWE to declare the problem leads to CWE-348. The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request middleware sees only the last value of a repeated header instead of the full chain. For applications that base access control on the X-Forwarded-For chain, this can weaken or alter that decision; for auditing, hop history is lost. This vulnerability is fixed in 4.12.25.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-54289 since 06/12/2026. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 4.12.25 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-38330). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• honojs

Name

• hono

Version

• 4.12.0
• 4.12.1
• 4.12.2
• 4.12.3
• 4.12.4
• 4.12.5
• 4.12.6
• 4.12.7
• 4.12.8
• 4.12.9
• 4.12.10
• 4.12.11
• 4.12.12
• 4.12.13
• 4.12.14
• 4.12.15
• 4.12.16
• 4.12.17
• 4.12.18
• 4.12.19
• 4.12.20
• 4.12.21
• 4.12.22
• 4.12.23
• 4.12.24

Website

• Product: https://github.com/honojs/hono/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion