Listen to this Post
How the Mentioned CVE Works
The vulnerability identified as AIKIDO-2026-362336 resides in the Hono framework’s AWS Lambda@Edge adapter. Hono is a popular web application framework, and its Lambda@Edge adapter is designed to translate CloudFront’s request format into a standard HTTP request object for the application.
When a client sends an HTTP request with a repeated header (e.g., X-Forwarded-For: client1, client2), CloudFront delivers this to the Lambda@Edge function as a list of separate entries, each containing the header name and one value. The adapter’s logic then iterates through this list to populate the internal headers object. The critical flaw is that for each entry, the adapter uses the `Headers.set` method instead of Headers.append.
The `Headers.set` method is designed to overwrite any existing value for a given header name, replacing it entirely with the new value. Consequently, as the adapter processes the list of repeated headers, each subsequent call to `Headers.set` overwrites the value written by the previous one. After the loop completes, only the last value from the list remains in the headers object. All earlier values are silently discarded.
This behavior is incorrect, as repeated headers represent an ordered list, and all values are significant. The correct method to use is Headers.append, which adds a new value to the header without removing existing ones, preserving the complete list. The impact is that any application logic that relies on the full chain of values—such as IP restriction middleware that parses the `X-Forwarded-For` chain to determine the original client IP, or auditing systems that log every hop from the `Forwarded` or `Via` headers—will receive incomplete and potentially misleading data.
The issue is specific to the Lambda@Edge adapter because API Gateway and other adapters within the Hono ecosystem correctly handle multi-value headers by appending them. An attacker cannot directly exploit this vulnerability to execute code, but they can manipulate the environment to bypass security controls. For instance, an attacker could craft a request with a spoofed IP address as the first `X-Forwarded-For` value and a legitimate IP as the second. Since the adapter only retains the last value (the legitimate one), the application might incorrectly trust the spoofed IP if its logic parses the list in a certain way, or more likely, it will see an incomplete chain and make an incorrect access decision based on the single, potentially attacker-controlled value.
DailyCVE Form
Platform: Hono
Version: 0.0.1 – 4.12.24
Vulnerability: Improper Authorization
Severity: Medium
date: 2026-06-16
Prediction: 2026-06-23
What Undercode Say
Check your Hono version
npm list hono
Example of the vulnerable code pattern (conceptual)
for (const header of cloudfrontHeaders) {
headers.set(header.name, header.value); // Vulnerable: overwrites
}
The corrected approach (conceptual)
for (const header of cloudfrontHeaders) {
headers.append(header.name, header.value); // Correct: appends
}
Exploit
An attacker can exploit this vulnerability by sending an HTTP request to an application deployed on AWS Lambda@Edge that uses a vulnerable version of Hono. The request must contain a repeated header that is used for security decisions, such as X-Forwarded-For.
For example, consider an application that uses IP-based allowlisting by checking the last IP in the `X-Forwarded-For` chain, assuming it’s the client’s IP. The attacker sends:
X-Forwarded-For: 192.168.1.1, 10.0.0.1
Due to the bug, the adapter will only store 10.0.0.1. If the allowlist permits 10.0.0.1, the attacker gains access, even though the actual client IP might be `192.168.1.1` or some other untrusted address. The application’s security decision is based on incomplete data, leading to a potential bypass of IP-based restrictions.
Protection
Upgrade Hono: The primary and most effective protection is to upgrade the `hono` library to version 4.12.25 or later, which contains the fix for this vulnerability.
Migrate Adapter: If upgrading is not immediately possible, consider migrating your application away from the Lambda@Edge adapter to one that correctly handles multi-value headers, such as the API Gateway adapter, if your architecture allows.
Review Security Logic: As a temporary measure, review any security middleware that relies on multi-value headers. Ensure that your logic does not make assumptions about the completeness of the header chain, though this is not a complete fix.
Impact
Bypass of Access Controls: Applications using IP-based restrictions (e.g., via X-Forwarded-For) can have their security weakened or completely bypassed, allowing unauthorized access to resources.
Loss of Audit Trails: Auditing and logging systems that rely on the full hop history from headers like `Forwarded` or `Via` will receive incomplete data, hindering forensic analysis and incident response.
Incorrect Decision Making: Any middleware or application logic that processes multi-value headers may make incorrect decisions based on the truncated data, potentially leading to broader logical flaws in the application.
Affected Deployments: The vulnerability specifically impacts applications deployed on AWS Lambda@Edge that use the vulnerable Hono adapter and depend on multi-value request headers.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
