CVE-2026-59897: Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

July 21, 2026

The AWS API Gateway v1 adapter can drop a distinct repeated request header value. When a header appears multiple times, the adapter de-duplicates values using a substring comparison instead of an exact match, so a value that is a substring of another value of the same header is omitted (for example, 203.0.113.1 is dropped when another value is 203.0.113.10).

References

github.com/advisories/GHSA-xgm2-5f3f-mvvc
github.com/honojs/hono/commit/aa921770d09bc35970362d5a2630a878f6d982fd
github.com/honojs/hono/releases/tag/v4.12.27
github.com/honojs/hono/security/advisories/GHSA-xgm2-5f3f-mvvc
nvd.nist.gov/vuln/detail/CVE-2026-59897

Code Behaviors & Features

Detect and mitigate CVE-2026-59897 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →