CVE-2026-54289: hono Lambda@Edge Adapter Keeps Only The Vulnerability

MODERATE
Advisory Identifier: GHSA-wgpf-jwqj-8h8p
Share
CVSS 4.8
CWE-348
Published
Advisory Summary

CVE-2026-54289 is a MODERATE (CVSS 4.8) lambda@edge adapter keeps only the vulnerability (CWE-348: Use of Less Trusted Source) affecting hono libraries in the npm ecosystem. The issue involves lambda@edge adapter keeps only the last value of a repeated request header, dropping the rest. Remediation is available by upgrading affected packages to version 4.12.25.

CVE-2026-54289 at a Glance

CVE Identifier CVE-2026-54289
GHSA Identifier GHSA-wgpf-jwqj-8h8p
Severity MODERATE
CVSS v3.1 Base Score 4.8
CWE Classification CWE-348: Use of Less Trusted Source
Affected Product hono
Package Ecosystem npm
Published Date
Last Updated

Security Impact

CVSS: 4.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

Attack Vector Network (AV:N)
Attack Complexity High (AC:H)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality Low (C:L)
Integrity Low (I:L)
Availability None (A:N)

How to Fix CVE-2026-54289

To remediate this vulnerability, upgrade all affected hono dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

hono fixed: 4.12.25 
npm install hono@4.12.25
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls hono

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2026-54289, inspect your project dependencies using npm:

npm ls hono

Analyze the terminal output to locate any version of hono in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.12.25), your application is affected.

Note: The npm ls hono command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-348: Use of Less Trusted Source, where the product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack. In hono, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary On AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with `Headers.set` instead of `Headers.append`, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as `X-Forwarded-For`, `Forwarded`, and `Via` are silently truncated to a single value. ### Details A repeated request header carries an ordered list of values. The adapter iterates the list but overwrites on each step, keeping only the final value. Middleware that depends on the full list — for example IP restriction that walks the `X-Forwarded-For` chain, or auditing based on `Forwarded`/`Via` hops — receives incomplete data. The API Gateway adapter already appends repeated values and is not affected. This issue arises only on Lambda@Edge deployments, for requests that contain the same header more than once. ### Impact Request middleware sees only the last value of a repeated header instead of the full chain. For applications that base access control on the `X-Forwarded-For` chain, this can weaken or alter that decision; for auditing, hop history is lost. This affects applications deployed on AWS Lambda@Edge that rely on multi-value request headers.

CVE-2026-54289 Affected hono Versions

1 component(s)
Fixed Versions:
4.12.25
Product / Package Ecosystem Affected Versions Fixed Version
hono
npm/hono
npm
< 4.12.25
4.12.25

References

GitHub Advisory / Wiki ADVISORY
https://github.com/honojs/hono/security/advisories/GHSA-wgpf-jwqj-8h8p
NVD — CVE-2026-54289 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-54289
hono Source Repository REPOSITORY
https://github.com/honojs/hono

Frequently Asked Questions

What is CVE-2026-54289?
CVE-2026-54289 is a security vulnerability in hono involving Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest under CWE-348: Use of Less Trusted Source.
Which hono versions are affected?
Affected versions include releases prior to 4.12.25 across affected packages: hono.
What version fixes CVE-2026-54289?
Upgrading to 4.12.25 (or the latest patched release for your respective branch) resolves the vulnerability.
Is hono affected?
Yes, hono is affected in releases prior to 4.12.25. Upgrade your dependency to 4.12.25 or later.
What is the CVSS score of CVE-2026-54289?
CVE-2026-54289 has a CVSS v3.1 base score of 4.8 (MODERATE) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N.
What CWE is associated with CVE-2026-54289?
CVE-2026-54289 is classified under CWE-348: Use of Less Trusted Source (The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.).
How can I check npm dependencies for CVE-2026-54289?
Run the dependency tree command: 'npm ls hono'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-wgpf-jwqj-8h8p",
  "modified" : "2026-07-21T15:26:57Z",
  "published" : "2026-06-16T14:32:31Z",
  "aliases" : [ "CVE-2026-54289" ],
  "summary" : "hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest",
  "details" : "### Summary\n\nOn AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with `Headers.set` instead of `Headers.append`, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as `X-Forwarded-For`, `Forwarded`, and `Via` are silently truncated to a single value.\n\n### Details\n\nA repeated request header carries an ordered list of values. The adapter iterates the list but overwrites on each step, keeping only the final value. Middleware that depends on the full list — for example IP restriction that walks the `X-Forwarded-For` chain, or auditing based on `Forwarded`/`Via` hops — receives incomplete data. The API Gateway adapter already appends repeated values and is not affected.\n\nThis issue arises only on Lambda@Edge deployments, for requests that contain the same header more than once.\n\n### Impact\n\nRequest middleware sees only the last value of a repeated header instead of the full chain. For applications that base access control on the `X-Forwarded-For` chain, this can weaken or alter that decision; for auditing, hop history is lost. This affects applications deployed on AWS Lambda@Edge that rely on multi-value request headers.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "hono"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.12.25"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/honojs/hono/security/advisories/GHSA-wgpf-jwqj-8h8p"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-54289"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/honojs/hono"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-348" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-16T14:32:31Z",
    "nvd_published_at" : "2026-06-22T18:16:47Z"
  }
}