Hono is a JavaScript web framework that runs on any JavaScript runtime. In versions 4.12.0 and 4.12.1 the getConnInfo function incorrectly parses the X-Forwarded-For header by taking its first value. Because an AWS Application Load Balancer appends the real client IP to the end of the header, the first entry can be supplied by an attacker. This flaw allows an attacker to forge the header and bypass IP-based access control mechanisms such as the ipRestriction middleware, effectively gaining authenticated access without proper credentials.

Affected systems are deployments of the Hono framework v4.12.0 through v4.12.1 running on Node.js when used with the AWS Lambda adapter behind an AWS Application Load Balancer. The issue is present only in those specific versions; the fix was introduced in version 4.12.2.

The vulnerability carries a CVSS score of 8.2, indicating high severity, but its EPSS score is below 1 % and it is not listed in the CISA KEV catalog, suggesting a low current exploitation chance. The attack vector would involve an attacker sending traffic to the ALB with a forged X-Forwarded-For header; the framework then uses the attacker-controlled value for IP checks, allowing a bypass. No known public exploits exist yet, but the flaw can be mitigated by upgrading or reconfiguring the load balancer or framework.