The Hono web application framework's AWS API Gateway v1 adapter versions >=4.3.3 and <4.12.27 improperly handle repeated request header values by de-duplicating them based on substring comparison rather than exact matches. This leads to loss of distinct repeated header values, affecting components that rely on the complete X-Forwarded-For chain for functionality like rate limiting, audit logging, or proxy-chain validation. The vulnerability is identified as CWE-348 (Use of Less Trusted Source) and is resolved in version 4.12.27.

Middleware or application logic that depends on the complete X-Forwarded-For header chain may receive incomplete or inaccurate data, potentially impacting rate limiting, audit logging, and proxy-chain validation. This can reduce the reliability of security controls and monitoring that rely on accurate client IP information. The CVSS score is 4.8 (medium severity), indicating limited confidentiality and integrity impact with no availability impact.

A patch is available and the issue is fixed in Hono version 4.12.27. Users should upgrade to version 4.12.27 or later to resolve this vulnerability. Since this is a cloud service, the vendor manages remediation for the cloud-hosted service; users should verify with the vendor that the service is updated accordingly.