CVE-2026-27700: hono Authentication Bypass by Spoofing

Vulnerability summary

CVE-2026-27700 is a high (CVSS 8.2) Authentication Bypass by Spoofing vulnerability in hono. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.3% of scored vulnerabilities.

Timeline

1. 25-02-2026
   PublishedVulnerability first disclosed.
2. 27-02-2026
   Last modifiedVulnerability information updated.

Description

Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter (`hono/aws-lambda`) behind an Application Load Balancer (ALB), the `getConnInfo()` function incorrectly selected the first value from the `X-Forwarded-For` header. Because AWS ALB appends the real client IP address to the end of the `X-Forwarded-For` header, the first value can be attacker-controlled. This could allow IP-based access control mechanisms (such as the `ipRestriction` middleware) to be bypassed. Version 4.12.2 patches the issue.

• CWE-290Authentication Bypass by SpoofingThis attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
• CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.