Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-27700: Hono 4.12.0‑4.12.1 allows IP spoofing to bypass access controls

CVE-2026-27700 · published 8 months ago

Summary

The Hono web framework’s AWS Lambda adapter in versions 4.12.0 and 4.12.1 can be tricked by a forged X‑Forwarded‑For header, letting an attacker appear to come from an allowed IP address. This lets IP‑based restrictions be ignored, potentially exposing protected functions. Upgrade to version 4.12.2 or later to fix the issue.

What to do

Update yusukebe hono to version 4.12.2.
Update hono hono to version 4.12.2 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	yusukebe	hono	>= 4.12.0, < 4.12.2 Fix: upgrade to 4.12.2
–	hono	hono	>= 4.12.0, < 4.12.2 `cpe:2.3:a:hono:hono::::::node.js::*`

Original advisory text

Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo

Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter (`hono/aws-lambda`) behind an Application Load Balancer (ALB), the `getConnInfo()` function incorrectly selected the first value from the `X-Forwarded-For` header. Because AWS ALB appends the real client IP address to the end of the `X-Forwarded-For` header, the first value can be attacker-controlled. This could allow IP-based access control mechanisms (such as the `ipRestriction` middleware) to be bypassed. Version 4.12.2 patches the issue.

References

https://github.com/advisories/GHSA-xh87-mx6m-69f3
https://nvd.nist.gov/vuln/detail/CVE-2026-27700 Vendor Advisory
https://github.com/honojs/hono/releases/tag/v4.12.2 URL
https://github.com/honojs/hono/commit/41adbf56e252c04611f8972364ac0887ae07a4c7 Patch
https://github.com/honojs/hono/security/advisories/GHSA-xh87-mx6m-69f3 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27700... Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.2 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-290Authentication Bypass by Spoofing

CWE-345Insufficient Verification of Data Authenticity

Timeline

Published25 Feb 2026

Updated4 Nov 2026

First seen6 Mar 2026

Sources

CVE-2026-27700 · NVD

GHSA-xh87-mx6m-69f3 · GHSA

CVE-2026-27700 · OSV

Track software like this

Free during beta