CVE-2026-27700

HIGH EPSS 15.4%
Published Feb 25, 20264mo ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Feb 25, 2026 4mo ago
Last Modified Jun 17, 2026 2w ago

Description

Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter (`hono/aws-lambda`) behind an Application Load Balancer (ALB), the `getConnInfo()` function incorrectly selected the first value from the `X-Forwarded-For` header. Because AWS ALB appends the real client IP address to the end of the `X-Forwarded-For` header, the first value can be attacker-controlled. This could allow IP-based access control mechanisms (such as the `ipRestriction` middleware) to be bypassed. Version 4.12.2 patches the issue.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
15.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-290
CWE-345

Affected Products 1

VendorProductVersionRange
honohono*≥4.12.0  –  <4.12.2

References 3

  • github.com https://github.com/honojs/hono/commit/41adbf56e252c04611f8972364ac0887ae07a4c7
    Patch
  • github.com https://github.com/honojs/hono/releases/tag/v4.12.2
    ProductRelease Notes
  • github.com https://github.com/honojs/hono/security/advisories/GHSA-xh87-mx6m-69f3
    Vendor Advisory

Remediation

  • github.com https://github.com/honojs/hono/commit/41adbf56e252c04611f8972364ac0887ae07a4c7
    Patch