{"action":"Upgrade hono to 4.12.27 or later.","affected":[{"fixed":"4.12.27","introduced":"4.3.3"}],"component":"hono","cve_ids":["CVE-2026-59897"],"ecosystem":"npm","epss":0.0018,"exploited":false,"fixed_versions":["4.12.27"],"ghsa_id":"GHSA-xgm2-5f3f-mvvc","id":"tcs_01M5KGJ00JHGQ0NSY057T4VCVJ","modified_at":"2026-09-10T03:50:53.167967172Z","published_at":"2026-07-21T18:18:13Z","references":["https://osv.dev/vulnerability/GHSA-xgm2-5f3f-mvvc","https://github.com/honojs/hono/security/advisories/GHSA-xgm2-5f3f-mvvc","https://nvd.nist.gov/vuln/detail/CVE-2026-59897","https://github.com/honojs/hono/commit/aa921770d09bc35970362d5a2630a878f6d982fd","https://github.com/honojs/hono","https://github.com/honojs/hono/releases/tag/v4.12.27"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-xgm2-5f3f-mvvc","url":"https://osv.dev/vulnerability/GHSA-xgm2-5f3f-mvvc"}],"summary":"Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication"}