The AWS API Gateway v1 adapter in the Hono framework performs header de‑duplication by comparing substrings rather than exact values. When an HTTP request contains duplicate X-Forwarded-For header entries, the adapter drops the later values and retains only the first. This truncates the chain that middleware or application logic relies on for functions such as rate limiting, audit logging, or proxy‑chain validation. The result is that controls expecting the full header sequence may be bypassed, compromising the integrity of request processing but not providing direct code execution or privilege escalation.

Versions of the Hono JavaScript framework from 4.3.3 up to, but not including, 4.12.27 that utilize the AWS API Gateway v1 adapter are affected. Deployments that route HTTP traffic through this adapter are at risk.

The CVSS score of 4.8 denotes moderate severity, while the EPSS score being less than 1% indicates a low current likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker can trigger the issue by sending a crafted HTTP request that contains duplicate X-Forwarded-For headers; the resulting truncated header chain can cause security controls that depend on the full chain to fail. No evidence of arbitrary code execution or privilege escalation is present in the CVE data.