Hono - Vary Header Injection in CORS Middleware
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Hono before 4.10.3 contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response. Because Vary is a response header that should be managed by the server, an attacker can supply arbitrary Vary values that are reflected into the response, potentially causing cache key pollution and inconsistent CORS enforcement in environments that rely on shared caches or proxies.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| honojs | Hono | before 4.10.3 | 4.10.3 | Patch available | CNA |
| — | hono (npm) | before 4.10.3 | 4.10.3 | Patch available | GHSA-q7jf-gf43-6x6p |
- Hono Vendorhonojs Affected before 4.10.3 Fixed in 4.10.3 Patch available CNA
- hono (npm) Vendor— Affected before 4.10.3 Fixed in 4.10.3 Patch available GHSA-q7jf-gf43-6x6p
Remediation
- Fix · CNA Hono (Hono) Fixed in 4.10.3
- Fix · GHSA-q7jf-gf43-6x6p hono (npm) Fixed in 4.10.3 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 5 products
- Migration Toolkit for Applications 8
- Red Hat Ansible Automation Platform 2
- Red Hat Developer Hub 1
- Red Hat Hardened Images
- Red Hat OpenShift Dev Spaces
Timeline
- 2026-10-02 Threatist record created from CVE-2025-71381
- 2026-10-03 Alias added: GHSA-q7jf-gf43-6x6p
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-29 Fix available: Hono/[email protected] · CNA
References
More honojs vulnerabilities
- TI-2024-21741 Hono vulnerable to Restricted Directory Traversal in serveStatic with deno CVSS 3.1MEDIUM 5.3
- TI-2024-15441 @hono/node-server can't handle "double dots" in URL CVSS 3.1MEDIUM 5.3
- TI-2024-32610 Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header. CVSS 3.1MEDIUM 5.9
- TI-2024-29381 Hono CSRF middleware can be bypassed using crafted Content-Type header CVSS 3.1MEDIUM 5.0
- TI-2026-39189 Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest CVSS 3.1MEDIUM 4.8
- TI-2026-23190 Hono: Arbitrary file access via serveStatic vulnerability CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-71381 · CVE Program
- CVE-2025-71381 · NVD
- FIRST EPSS
- GHSA-q7jf-gf43-6x6p · GitHub Advisory Database · CC BY 4.0
- CVE-2025-71381 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences