CVE-2026-59897

Katalog CVE

CVSS 5.3 · Medium EPSS 0,18%

Kerentanan Use of Less Trusted Source pada hono. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware or application logic that depends on the complete X-Forwarded-For chain, rate limiting, audit logging, or proxy-chain validation can receive incomplete data. This issue is fixed in version 4.12.27.

Rincian

Terbit di NVD

8 Juli 2026

Terakhir diubah

10 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-348: Use of Less Trusted Source

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/honojs/hono/security/advisories/GHSA-xgm2-5f3f-mvvc advisory vendor
• https://github.com/honojs/hono/commit/aa921770d09bc35970362d5a2630a878f6d982fd patch
• https://github.com/honojs/hono/releases/tag/v4.12.27 release notes