Hono, a JavaScript web framework, incorrectly overwrites repeated CloudFront request headers on AWS Lambda@Edge by using Headers.set rather than Headers.append. When a header such as X‑Forwarded‑For, Forwarded, or Via appears multiple times, only the last value is kept; the earlier values are silently dropped. Applications that rely on the full hop chain for access‑control decisions or auditing can therefore make incorrect authorisation choices or lose traceability. The weakness is an incomplete conversion of input data (CWE‑348).

The flaw affects all instances of the Hono framework deployed on AWS Lambda@Edge with a version earlier than 4.12.25. It is specific to the Lambda@Edge adapter and does not impact other hosting platforms or newer framework releases.

The CVSS score of 4.8 indicates a moderate severity effect. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, suggesting that mass exploitation is unlikely at present. The likely attack vector is a legitimate web request that carries duplicate headers; the flaw is implicitly triggered by normal operation of the application, making it easy to exploit for an attacker who can influence the contents of those headers. Because the vulnerability alters the information used for security decisions, the impact can be significant for user‑integrity and audit‑trail purposes.