CVE-2026-27700 - Vulnerability Analysis

Overview

Hono 4.12.0 and 4.12.1 contain an IP restriction bypass caused by incorrect selection of the first value in the X-Forwarded-For header in hono/aws-lambda behind AWS ALB, letting attackers bypass IP-based access control, exploit requires use behind AWS ALB.

Severity & Score

Impact

Attackers can bypass IP-based access controls, potentially gaining unauthorized access to restricted resources.

Mitigation

Upgrade to version 4.12.2 or later.

References

• https://github.com/honojs/hono/commit/41adbf56e252c04611f8972364ac0887ae07a4c7
• https://github.com/honojs/hono/releases/tag/v4.12.2
• https://github.com/honojs/hono/security/advisories/GHSA-xh87-mx6m-69f3

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 25, 2026

🟠 CVE-2026-27700 - High (8.2) Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter (`hono/aws-lambda`) behind an Application Load Balancer (ALB), the `getConnInfo()` function inco... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27700/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner