CVE-2026-54289
CVE-2026-54289 is a medium-severity vulnerability with a CVSS 3.x base score of 4.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-348.
Key facts
- Severity: Medium (CVSS 3.x base score 4.8)
- EPSS exploit prediction: 0% (7th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-38330
- Weakness: CWE-348
- Published:
- Last modified:
Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request middleware sees only the last value of a repeated header instead of the full chain. For applications that base access control on the X-Forwarded-For chain, this can weaken or alter that decision; for auditing, hop history is lost. This vulnerability is fixed in 4.12.25.
Frequently asked questions
- What is CVE-2026-54289?
- Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request middleware sees only the last value of a repeated header instead of the full chain. For applications that base access control on the X-Forwarded-For chain, this can weaken or alter that decision; for auditing, hop history is lost. This vulnerability is fixed in 4.12.25.
- How severe is CVE-2026-54289?
- CVE-2026-54289 has a CVSS 3.x base score of 4.8, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
- Is CVE-2026-54289 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-54289?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2026-54289 have an EU (EUVD) identifier?
- Yes. CVE-2026-54289 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-38330.
- When was CVE-2026-54289 published?
- CVE-2026-54289 was published on 2026-06-22.
References
Other CWE-348 vulnerabilities
- CVE-2026-48772 — Critical (CVSS 10.0): ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 2.0.0 through 3.0.8, the ProxySQL MySQL…
- CVE-2026-93483 — Critical (CVSS 9.5): In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to…
- CVE-2026-97404 — Critical (CVSS 9.2): In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an…
- CVE-2026-16272 — Critical (CVSS 9.1): Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos…
- CVE-2026-58122 — Critical (CVSS 9.1): Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote…
- CVE-2026-12249 — Critical (CVSS 9.0): An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Directory Certificate…