Vulnerability · Published Feb 25, 2026 · Assigned by GitHub_M

CVE-2026-27700Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo

High 8.2

In plain English

A high-severity insufficient verification of data authenticity in hono from honojs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.3%top 80.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter (`hono/aws-lambda`) behind an Application Load Balancer (ALB), the `getConnInfo()` function incorrectly selected the first value from the `X-Forwarded-For` header. Because AWS ALB appends the real client IP address to the end of the `X-Forwarded-For` header, the first value can be attacker-controlled. This could allow IP-based access control mechanisms (such as the `ipRestriction` middleware) to be bypassed. Version 4.12.2 patches the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	hono	4.12.2	GHSA-xh87-mx6m-69f3

Affected products (as reported)

Vendor	Product	Versions
honojs	hono	>= 4.12.0, < 4.12.2

Weakness: CWE-345, CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

https://github.com/honojs/hono/security/advisories/GHSA-xh87-mx6m-69f3 x_refsource_CONFIRM
https://github.com/honojs/hono/commit/41adbf56e252c04611f8972364ac0887ae07a4c7 x_refsource_MISC
https://github.com/honojs/hono/releases/tag/v4.12.2 x_refsource_MISC