{"id":"CVE-2026-27700","aliases":["EUVD-2026-8644","GHSA-xh87-mx6m-69f3"],"status":"published","title":"Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo","description":"Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter (`hono/aws-lambda`) behind an Application Load Balancer (ALB), the `getConnInfo()` function incorrectly selected the first value from the `X-Forwarded-For` header. Because AWS ALB appends the real client IP address to the end of the `X-Forwarded-For` header, the first value can be attacker-controlled. This could allow IP-based access control mechanisms (such as the `ipRestriction` middleware) to be bypassed. Version 4.12.2 patches the issue.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00269,"percentile":0.19216,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-290","CWE-345"],"published":"2026-02-25T15:01:44Z","modified":"2026-10-28T02:31:09Z","fixes":[{"ecosystem":"npm","package":"hono","fixed_in":["4.12.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"hono","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.12.0"},{"fixed":"4.12.2"}]}]},{"source":"osv","ecosystem":"npm","package":"hono","ranges":[{"type":"SEMVER","events":[{"introduced":"4.12.0"},{"fixed":"4.12.2"}]}]}],"products":[{"vendor":"hono","product":"hono"},{"vendor":"honojs","product":"hono"}],"references":[{"url":"https://github.com/honojs/hono/security/advisories/GHSA-xh87-mx6m-69f3","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/honojs/hono/commit/41adbf56e252c04611f8972364ac0887ae07a4c7","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/honojs/hono/releases/tag/v4.12.2","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27700","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xh87-mx6m-69f3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27700.json","tags":["advisory"]},{"url":"https://github.com/honojs/hono","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-27700","title":"Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo","description":"Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter (`hono/aws-lambda`) behind an Application Load Balancer (ALB), the `getConnInfo()` function incorrectly selected the first value from the `X-Forwarded-For` header. Because AWS ALB appends the real client IP address to the end of the `X-Forwarded-For` header, the first value can be attacker-controlled. This could allow IP-based access control mechanisms (such as the `ipRestriction` middleware) to be bypassed. Version 4.12.2 patches the issue.","status":"published","published":"2026-02-25T15:01:44.681Z","modified":"2026-02-27T17:01:28.403Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-345","CWE-290"],"updated_at":"2026-11-02T14:19:48.826324Z"}],"euvd":[{"id":"EUVD-2026-8644","description":"Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter (`hono/aws-lambda`) behind an Application Load Balancer (ALB), the `getConnInfo()` function incorrectly selected the first value from the `X-Forwarded-For` header. Because AWS ALB appends the real client IP address to the end of the `X-Forwarded-For` header, the first value can be attacker-controlled. This could allow IP-based access control mechanisms (such as the `ipRestriction` middleware) to be bypassed. Version 4.12.2 patches the issue.","status":"published","published":"2026-02-25T15:01:44Z","modified":"2026-02-27T17:01:28Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T19:48:13.609806Z"}],"ghsa":[{"id":"GHSA-xh87-mx6m-69f3","title":"Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo","description":"## Summary\n\nWhen using the AWS Lambda adapter (`hono/aws-lambda`) behind an Application Load Balancer (ALB), the `getConnInfo()` function incorrectly selected the first value from the `X-Forwarded-For` header.\n\nBecause AWS ALB appends the real client IP address to the end of the `X-Forwarded-For` header, the first value can be attacker-controlled.\n\nThis could allow IP-based access control mechanisms (such as the `ipRestriction` middleware) to be bypassed.\n\n## Details\n\nIn ALB environments, AWS appends the actual client IP address to the end of any existing `X-Forwarded-For` header value. However, the previous implementation of `getConnInfo()` extracted the leftmost IP address:\n\n```ts\naddress = xff.split(',')[0].trim()\n```\n\nIf a client sent:\n\n```\nX-Forwarded-For: \u003cspoofed-ip\u003e\n```\n\nALB would forward:\n\n```\nX-Forwarded-For: \u003cspoofed-ip\u003e, \u003creal-client-ip\u003e\n```\n\nSince the implementation selected the first value, the spoofed IP address was trusted. This affected applications using:\n\n```ts\nipRestriction(getConnInfo, { allowList: [...] })\n```\n\nor any custom middleware relying on `getConnInfo(c).remote.address` for authorization decisions.\n\nThe issue only affects deployments using the AWS Lambda adapter behind an ALB. API Gateway (v1/v2) and Lambda Function URLs are not affected, as they use AWS-provided source IP values from `requestContext`.\n\n## Impact\n\nAn unauthenticated remote attacker could bypass IP-based access restrictions by supplying a crafted `X-Forwarded-For` header. This may allow access to resources that were intended to be restricted by IP address.\n\nOnly applications deployed behind an ALB and relying on `getConnInfo()` for IP-based authorization are affected.","status":"published","published":"2026-02-25T18:02:19Z","modified":"2026-02-27T20:55:24Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-290","CWE-345"],"updated_at":"2026-11-02T14:39:28.962954Z"}],"nvd":[{"id":"CVE-2026-27700","description":"Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter (`hono/aws-lambda`) behind an Application Load Balancer (ALB), the `getConnInfo()` function incorrectly selected the first value from the `X-Forwarded-For` header. Because AWS ALB appends the real client IP address to the end of the `X-Forwarded-For` header, the first value can be attacker-controlled. This could allow IP-based access control mechanisms (such as the `ipRestriction` middleware) to be bypassed. Version 4.12.2 patches the issue.","status":"published","published":"2026-02-25T16:23:26.44Z","modified":"2026-06-17T10:27:32.397Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-290","CWE-345"],"updated_at":"2026-11-02T14:12:07.027269Z"}],"osv":[{"id":"CVE-2026-27700","title":"Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo","description":"Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter (`hono/aws-lambda`) behind an Application Load Balancer (ALB), the `getConnInfo()` function incorrectly selected the first value from the `X-Forwarded-For` header. Because AWS ALB appends the real client IP address to the end of the `X-Forwarded-For` header, the first value can be attacker-controlled. This could allow IP-based access control mechanisms (such as the `ipRestriction` middleware) to be bypassed. Version 4.12.2 patches the issue.","status":"published","published":"2026-02-25T15:01:44.681Z","modified":"2026-10-28T02:31:09.394651115Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-290","CWE-345"],"updated_at":"2026-11-02T15:45:00.180685Z"},{"id":"GHSA-xh87-mx6m-69f3","title":"Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo","description":"## Summary\n\nWhen using the AWS Lambda adapter (`hono/aws-lambda`) behind an Application Load Balancer (ALB), the `getConnInfo()` function incorrectly selected the first value from the `X-Forwarded-For` header.\n\nBecause AWS ALB appends the real client IP address to the end of the `X-Forwarded-For` header, the first value can be attacker-controlled.\n\nThis could allow IP-based access control mechanisms (such as the `ipRestriction` middleware) to be bypassed.\n\n## Details\n\nIn ALB environments, AWS appends the actual client IP address to the end of any existing `X-Forwarded-For` header value. However, the previous implementation of `getConnInfo()` extracted the leftmost IP address:\n\n```ts\naddress = xff.split(',')[0].trim()\n```\n\nIf a client sent:\n\n```\nX-Forwarded-For: \u003cspoofed-ip\u003e\n```\n\nALB would forward:\n\n```\nX-Forwarded-For: \u003cspoofed-ip\u003e, \u003creal-client-ip\u003e\n```\n\nSince the implementation selected the first value, the spoofed IP address was trusted. This affected applications using:\n\n```ts\nipRestriction(getConnInfo, { allowList: [...] })\n```\n\nor any custom middleware relying on `getConnInfo(c).remote.address` for authorization decisions.\n\nThe issue only affects deployments using the AWS Lambda adapter behind an ALB. API Gateway (v1/v2) and Lambda Function URLs are not affected, as they use AWS-provided source IP values from `requestContext`.\n\n## Impact\n\nAn unauthenticated remote attacker could bypass IP-based access restrictions by supplying a crafted `X-Forwarded-For` header. This may allow access to resources that were intended to be restricted by IP address.\n\nOnly applications deployed behind an ALB and relying on `getConnInfo()` for IP-based authorization are affected.","status":"published","published":"2026-02-25T18:02:19Z","modified":"2026-09-10T03:50:36.121374455Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-290","CWE-345"],"updated_at":"2026-11-02T15:46:59.835583Z"}]}}