CVE-2026-59897 describes a vulnerability in the honojs hono framework's AWS API Gateway v1 adapter between versions 4.3.3 and before 4.12.27. The adapter de-duplicates repeated request header values using substring comparison rather than exact matching, which can cause distinct repeated header values to be dropped. This affects headers like X-Forwarded-For, which are critical for middleware or application logic that depend on the full chain of forwarded IP addresses for rate limiting, audit logging, or proxy-chain validation. The vulnerability is classified under CWE-348 (Use of Less Trusted Source). The issue is resolved in version 4.12.27.

The vulnerability can cause middleware or application logic that relies on the complete X-Forwarded-For header chain to receive incomplete or inaccurate data. This may impair rate limiting, audit logging, or proxy-chain validation mechanisms, potentially reducing their effectiveness. The CVSS score is 4.8 (medium severity), indicating limited confidentiality and integrity impact with no availability impact.

A fix is available in hono version 4.12.27. Since this is a cloud service, the vendor typically manages remediation server-side. Users should verify with the vendor advisory that their environment is updated to version 4.12.27 or later to ensure the issue is resolved. No additional mitigation is indicated by the vendor advisory.