CVE-2026-59897: Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

July 21, 2026

The AWS API Gateway v1 adapter can drop a distinct repeated request header value. When a header appears multiple times, the adapter de-duplicates values using a substring comparison instead of an exact match, so a value that is a substring of another value of the same header is omitted (for example, 203.0.113.1 is dropped when another value is 203.0.113.10).

References

github.com/advisories/GHSA-xgm2-5f3f-mvvc
github.com/honojs/hono/commit/aa921770d09bc35970362d5a2630a878f6d982fd
github.com/honojs/hono/releases/tag/v4.12.27
github.com/honojs/hono/security/advisories/GHSA-xgm2-5f3f-mvvc
nvd.nist.gov/vuln/detail/CVE-2026-59897

Code Behaviors & Features

Detect and mitigate CVE-2026-59897 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →