CVE-2026-27700: Hono Package Vulnerable to Authentication Bypass via IP Spoofing
Summary
CVE-2026-27700: Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo. Affects hono versions >= 4.12.0, < 4.12.2. Fixed in 4.12.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hono is an open-source framework designed for building serverless applications, particularly in environments like AWS Lambda. It provides various functionalities, including middleware support for handling requests and responses. However, when deployed behind an AWS Application Load Balancer (ALB), it has a critical vulnerability that allows attackers to bypass IP-based access controls.
Vulnerability Detail
The vulnerability arises from the incorrect handling of the 'X-Forwarded-For' header in the AWS Lambda adapter for Hono. The 'getConnInfo()' function mistakenly selects the first IP address from this header, which can be controlled by an attacker. As a result, an attacker can spoof their IP address, allowing them to bypass IP-based restrictions and gain unauthorized access to resources. This issue specifically affects applications deployed behind an ALB, as it appends the real client IP address to the end of the 'X-Forwarded-For' header, making the first value potentially malicious.
How To Fix
Latest published version: 4.13.13 as of 23 Oct 2026
npm install hono@4.13.13Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.12.2
This is the first release that contains the fix.
npm install hono@4.12.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify the implementation of 'getConnInfo()' to extract the last IP address from the 'X-Forwarded-For' header instead of the first. Here is an example of how to do this:
const xff = req.headers['x-forwarded-for'] || '';
const address = xff.split(',').pop().trim();
This change will help ensure that the real client IP is used for authorization decisions until the package can be updated.
Conclusion
The Hono package has a critical vulnerability that allows for authentication bypass through IP spoofing when deployed behind an AWS ALB. It is essential to update to the patched version or implement the suggested workaround to secure your application.
See every vulnerability recorded for hono →
FAQ
An unauthenticated attacker can bypass IP-based access restrictions, potentially gaining access to restricted resources.
Only applications using the Hono package with the AWS Lambda adapter behind an ALB are affected.
You can use Vulert, which monitors and alerts for open-source vulnerabilities. Check your application with the Vulert playground at Vulert Scanner.
The CVSS score for this vulnerability is 8.2, indicating a high severity level.
Yes, updating to Hono version 4.12.2 or later provides a permanent fix for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for hono.
