All vulnerabilities
CVE-2025-71381GHSA-q7jf-gf43-6x6p

Hono vulnerable to Vary Header Injection leading to potential CORS Bypass

Hono hononpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
4.2Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.10.3Also 4.10.2GitHub
Published30 Jun 2026Updated 2 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

A flaw in the CORS middleware allowed request Vary headers to be reflected into the response, enabling attacker-controlled Vary values and potentially affecting cache behavior.

Details

The middleware previously copied the Vary header from the request when origin was not set to "*". Since Vary is a response header that should only be managed by the server, this could allow an attacker to influence caching behavior or cause inconsistent CORS handling.

Most environments will see impact only when shared caches or proxies rely on the Vary header. The practical effect varies by configuration.

Impact

May cause cache key pollution and inconsistent CORS enforcement in certain setups. No direct confidentiality, integrity, or availability impact in default configurations.

Resolution

Update to the latest patched release. The CORS middleware has been corrected to handle Vary exclusively as a response header.

Text from GitHub Advisory Database

Affected versions 4

  • hono, npm< 4.10.3GitHub
  • Honoaffected: all versions before 4.10.2CVE List
  • Honounaffected: 4.10.2CVE List
  • hono, npmfrom first release, fixed in 4.10.3OSV

References 5