CVE-2026-59897

Name of the Vulnerable Software and Affected Versions Hono versions 4.3.3 through 4.12.26

Description The AWS API Gateway v1 adapter incorrectly de-duplicates repeated request header values by using a substring comparison instead of an exact match. This behavior can lead to the loss of distinct header values, potentially causing incomplete data for application logic or middleware that relies on the X-Forwarded-For chain, rate limiting, audit logging, or proxy-chain validation.

Recommendations Update to version 4.12.27.