Use of Less Trusted Source Affecting hono package, versions >=4.3.3 <4.12.27

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Use of Less Trusted Source through the getHeaders processing in the AWS API Gateway v1 EventV1Processor and the Lattice LatticeV2Processor. An attacker can cause a repeated header value to be dropped by sending the same header multiple times, with one value as a substring of another, such as 203.0.113.1 alongside 203.0.113.10. This leaves the application with an incomplete Headers list that does not match the client's sent list. Middleware or application logic that depends on the full repeated header chain, such as IP filtering, audit logging, rate limiting, or proxy validation, can then make the wrong decision.

Notes

• The vulnerable path is the adapter’s merged-header handling: repeated values from multiValueHeaders/array-valued headers are collapsed before the app sees them, so deployments that rely on repeated request headers for X-Forwarded-For-style chain processing or similar middleware logic can receive an incomplete list.
• In AWS API Gateway v1, the single-value headers map is also consulted during request construction, so the issue is specific to the adapter’s event-to-Headers conversion rather than the upstream service; the maintainer's advisory affected scope is Hono deployments using that adapter path, with the same behavior mirrored in the Lattice V2 adapter.

• GitHub Commit
• Maintainer's Advisory