4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54289

CVE-2026-54289: hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request middleware sees only the last value of a repeated header instead of the full chain. For applications that base access control on the X-Forwarded-For chain, this can weaken or alter that decision; for auditing, hop history is lost. This vulnerability is fixed in 4.12.25.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54289

CVE-2026-54289:

4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hono	npm	< 4.12.25	4.12.25

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

This vulnerability in the Hono framework's Lambda@Edge adapter arises from incorrect handling of repeated HTTP request headers. On AWS Lambda@Edge, CloudFront can pass a single header with multiple values as a series of separate, repeated headers. The vulnerable adapter code iterated through these repeated headers but used headers.set(key, value) for each one. The set method overwrites any existing value for that header key. As a result, only the very last value in the series was preserved and passed to the application, while all preceding values were discarded.

This behavior leads to a loss of information for headers that rely on a complete chain of values, such as X-Forwarded-For, Forwarded, and Via. Security middleware that inspects these headers for tasks like IP-based access control or audit logging would operate on incomplete data. For instance, an IP restriction based on the X-Forwarded-For chain could be bypassed if the client can control the last value in the chain, as the preceding, more trusted values added by proxies would be dropped.

The fix involves changing the logic to use headers.append(key, value) instead of headers.set(key, value). The append method correctly adds the new value to the header, preserving the full list of values for repeated headers. This ensures that the application and any middleware receive the complete and accurate header information, mitigating the risk of security bypasses and data loss.

The vulnerable function, handle, is the entry point for processing incoming requests in the Lambda@Edge adapter. It is responsible for constructing the Request object, including its headers, before passing it to the Hono application for processing. The flaw in this function directly leads to the security vulnerability.

Vulnerable functions

handle

src/adapter/aws-lambda/handler.ts

The `handle` function in the Lambda@Edge adapter incorrectly processed request headers that appear multiple times. It used `headers.set()` to process each instance of a repeated header, which overwrites the previous value. This resulted in only the last value of headers like `X-Forwarded-For` being passed to the application, while the preceding values were discarded. This could allow an attacker to bypass security controls, such as IP-based access restrictions, that rely on the complete chain of values in such headers.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.