CVE-2026-54289

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.25

Description On AWS Lambda@Edge, CloudFront delivers request headers that appear multiple times as separate entries. The adapter uses the Headers.set function instead of Headers.append, causing each subsequent value to overwrite the previous one, meaning only the final value reaches the application. This results in the silent truncation of repeated request headers such as X-Forwarded-For, Forwarded, and Via to a single value. Consequently, request middleware receives incomplete data instead of the full chain. For applications utilizing the X-Forwarded-For chain for access control, this can weaken or alter security decisions, and for auditing purposes, the hop history is lost.

Recommendations Update to version 4.12.25.