{"items":[{"id":"NVI-00016357","kind":"vulnerability","title":"Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-xgm2-5f3f-mvvc","CVE-2026-59897"],"plain_summary":"GitHub lists this reviewed advisory for hono. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-6a942f9bbd390c21d34c73146bba80a6"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-21T18:18:14.000Z","value":"4.8 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-6a942f9bbd390c21d34c73146bba80a6"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-6a942f9bbd390c21d34c73146bba80a6","url":"https://github.com/advisories/GHSA-xgm2-5f3f-mvvc","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-xgm2-5f3f-mvvc","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T22:34:49.300Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-6a942f9bbd390c21d34c73146bba80a6"],"technology":"hono","known_exclusions":[],"conditions_summary":"### Summary\n\nThe AWS API Gateway v1 adapter can drop a distinct repeated request header value. When a header appears multiple times, the adapter de-duplicates values using a substring comparison instead of an exact match, so a value that is a substring of another value of the same header is omitted (for example, `203.0.113.1` is dropped when another value is `203.0.113.10`).\n\n### Details\n\nA repeated request header carries an ordered list of values. Middleware or application logic that depends on the complete list — such as IP restriction that walks the `X-Forwarded-For` chain, rate limiting, audit logging, or proxy-chain validation — can therefore receive incomplete data that differs from what the client actually sent.\n\nThis issue arises on deployments using the AWS API Gateway v1 adapter (the same pattern also affects the VPC Lattice adapter), for requests that contain the same header more than once.\n\n### Impact\n\nAn attacker can craft repeated header values so that one value is omitted before the application sees the request. Where a security or routing decision relies on the full chain, this can alter that decision.\n\nThis affects applications deployed through Hono's AWS API Gatew","public_affected_ranges":[">= 4.3.3, < 4.12.27"]}],"null_published_at":"2026-11-04T10:04:27.935Z","source_updated_at":"2026-07-21T18:18:14.000Z","source_disclosed_at":"2026-07-21T18:18:13.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T22:34:49.300Z"}],"next_cursor":null,"snapshot_revision":"42594"}