CVE-2026-54289
CVE-2026-54289 is a medium-severity vulnerability with a CVSS 3.x base score of 4.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-348.
Key facts
- Severity: Medium (CVSS 3.x base score 4.8)
- EPSS exploit prediction: 0% (2nd percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-38330
- Weakness: CWE-348
- Published:
- Last modified:
Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request middleware sees only the last value of a repeated header instead of the full chain. For applications that base access control on the X-Forwarded-For chain, this can weaken or alter that decision; for auditing, hop history is lost. This vulnerability is fixed in 4.12.25.
Frequently asked questions
- What is CVE-2026-54289?
- Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request middleware sees only the last value of a repeated header instead of the full chain. For applications that base access control on the X-Forwarded-For chain, this can weaken or alter that decision; for auditing, hop history is lost. This vulnerability is fixed in 4.12.25.
- How severe is CVE-2026-54289?
- CVE-2026-54289 has a CVSS 3.x base score of 4.8, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
- Is CVE-2026-54289 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (2nd percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-54289?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2026-54289 have an EU (EUVD) identifier?
- Yes. CVE-2026-54289 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-38330.
- When was CVE-2026-54289 published?
- CVE-2026-54289 was published on 2026-06-22.
References
Other CWE-348 vulnerabilities
- CVE-2026-48772 — Critical (CVSS 10.0): ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 2.0.0 through 3.0.8, the ProxySQL MySQL…
- CVE-2026-12249 — Critical (CVSS 9.0): An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Directory Certificate…
- CVE-2025-69240 — High (CVSS 8.8): Raytha CMS allows an attacker to spoof `X-Forwarded-Host` or `Host` headers to attacker controlled domain. The attacker…
- CVE-2025-55292 — High (CVSS 8.2): Meshtastic is an open source mesh networking solution. In the current Meshtastic architecture, a Node is identified by…
- CVE-2026-43634 — High (CVSS 7.5): HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers…
- CVE-2026-35391 — High (CVSS 7.5): Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the getClientIP() function…