{"id":"EUVD-2026-8644","enisaUuid":"aa35e6d0-79d4-31a9-8365-491142db728e","description":"Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter (`hono/aws-lambda`) behind an Application Load Balancer (ALB), the `getConnInfo()` function incorrectly selected the first value from the `X-Forwarded-For` header. Because AWS ALB appends the real client IP address to the end of the `X-Forwarded-For` header, the first value can be attacker-controlled. This could allow IP-based access control mechanisms (such as the `ipRestriction` middleware) to be bypassed. Version 4.12.2 patches the issue.","datePublished":"Feb 25, 2026, 3:01:44 PM","dateUpdated":"Feb 27, 2026, 5:01:28 PM","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-xh87-mx6m-69f3\nhttps://github.com/honojs/hono/commit/41adbf56e252c04611f8972364ac0887ae07a4c7\nhttps://github.com/honojs/hono/releases/tag/v4.12.2\n","aliases":"CVE-2026-27700\nGHSA-xh87-mx6m-69f3\n","assigner":"GitHub_M","epss":0.27,"enisaIdProduct":[{"id":"905905a8-2642-3ab2-95aa-0e60b421da99","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"4.12.0, \u003c 4.12.2"}],"enisaIdVendor":[{"id":"fe490806-6110-34ed-b24d-ab75013cb657","vendor":{"name":"honojs"}}],"enisaIdVulnerability":[{"id":"9c8644f7-ca09-3228-a5ad-c065232dc144","vulnerability":{"id":"CVE-2026-27700","description":"Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter (`hono/aws-lambda`) behind an Application Load Balancer (ALB), the `getConnInfo()` function incorrectly selected the first value from the `X-Forwarded-For` header. Because AWS ALB appends the real client IP address to the end of the `X-Forwarded-For` header, the first value can be attacker-controlled. This could allow IP-based access control mechanisms (such as the `ipRestriction` middleware) to be bypassed. Version 4.12.2 patches the issue.","datePublished":"Feb 25, 2026, 3:01:44 PM","dateUpdated":"Feb 27, 2026, 5:01:28 PM","status":"PUBLISHED","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-xh87-mx6m-69f3\nhttps://github.com/honojs/hono/commit/41adbf56e252c04611f8972364ac0887ae07a4c7\nhttps://github.com/honojs/hono/releases/tag/v4.12.2\n","enisa_id":"EUVD-2026-8644\n","assigner":"GitHub_M","epss":0.27,"dataProcessed":"Nov 13, 2026, 7:21:32 AM","vulnerabilityProduct":[{"id":"787c508a-272a-3ccd-8f6f-6e177f363cae","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"4.12.0, \u003c 4.12.2"}],"vulnerabilityVendor":[{"id":"1f692f9c-2199-38a7-801a-c8208db016ca","vendor":{"name":"honojs"}}]}},{"id":"f0290c00-d0e0-32ca-aedf-2a3ccc51bcb9","vulnerability":{"id":"GHSA-xh87-mx6m-69f3","description":"Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo","datePublished":"Feb 25, 2026, 6:02:19 PM","dateUpdated":"Feb 27, 2026, 8:55:22 PM","baseScore":0.0,"references":"https://github.com/honojs/hono/security/advisories/GHSA-xh87-mx6m-69f3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-27700\nhttps://github.com/honojs/hono/commit/41adbf56e252c04611f8972364ac0887ae07a4c7\nhttps://github.com/honojs/hono\nhttps://github.com/honojs/hono/releases/tag/v4.12.2\n","enisa_id":"EUVD-2026-8644\n","aliases":"CVE-2026-27700\nGHSA-xh87-mx6m-69f3\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:45:46 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}