CVE-2026-27700
Hono is a Web application framework that provides support for any JavaScript runtime.
Published Feb 25, 2026 · updated Jun 17, 2026 · hono hono
Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter ( ) behind an Application Load Balancer (ALB), the function incorrectly selected the first value from the header. Because AWS ALB appends the real client IP address to the end of the header, the first value can be attacker-controlled. This could allow IP-based access control mechanisms (such as the middleware) to be bypassed. Version 4.12.2 patches the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Feb 25, 2026 · NIST NVD
Detected
Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter ( ) behind an Application Load Balancer (ALB), the function incorrectly selected the first value from the header. Because AWS ALB appends the real client IP address to the end of the header, the first value can be attacker-controlled. This could all
Jun 17, 2026 · NIST NVD
Updated
Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter ( ) behind an Application Load Balancer (ALB), the function incorrectly selected the first value from the header. Because AWS ALB appends the real client IP address to the end of the header, the first value can be attacker-controlled. This could all
Affected
- cpe hono/honoversion unspecified
Sources
- NIST NVDVulnerability recordCVE-2026-27700
Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter ( ) behind an Application Load Balancer (ALB), the function incorrectly selected the first value
nvd.nist.gov