claudeenmodel: claude-sonnet-4-20250514
Hono v4.12.2 - Security Fix for AWS Lambda Adapter
Key Points
- Security fix for X-Forwarded-For handling
- AWS Lambda adapter vulnerability patched
- IP-based access control bypass prevented
Summary
Hono v4.12.2 is a security patch release that addresses a critical vulnerability in the AWS Lambda adapter's handling of X-Forwarded-For headers behind Application Load Balancer (ALB).
Key Points
- Security Fix: Fixed incorrect X-Forwarded-For header handling in AWS Lambda adapter
- Vulnerability Impact: Could allow IP-based access control bypass when deployed behind ALB
- Change: Reverted PR #4707 to address the security issue
- Advisory: Full details available in GHSA-xh87-mx6m-69f3
- Contributors: Thanks to @EdamAme-x for identifying the issue