GHSA-q7jf-gf43-6x6p
Suggest an improvement- Source
- https://github.com/advisories/GHSA-q7jf-gf43-6x6p
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-q7jf-gf43-6x6p/GHSA-q7jf-gf43-6x6p.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-q7jf-gf43-6x6p
- Aliases
- Downstream
- Published
- 2025-10-24T19:15:13Z
- Modified
- 2026-07-08T07:35:47Z
- Severity
-
- 4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
- Summary
- Hono vulnerable to Vary Header Injection leading to potential CORS Bypass
- Details
-
Summary
A flaw in the CORS middleware allowed request
Varyheaders to be reflected into the response, enabling attacker-controlledVaryvalues and potentially affecting cache behavior.Details
The middleware previously copied the
Varyheader from the request whenoriginwas not set to"*". SinceVaryis a response header that should only be managed by the server, this could allow an attacker to influence caching behavior or cause inconsistent CORS handling.Most environments will see impact only when shared caches or proxies rely on the
Varyheader. The practical effect varies by configuration.Impact
May cause cache key pollution and inconsistent CORS enforcement in certain setups. No direct confidentiality, integrity, or availability impact in default configurations.
Resolution
Update to the latest patched release. The CORS middleware has been corrected to handle
Varyexclusively as a response header. - Database specific
{ "cwe_ids": [ "CWE-444" ], "github_reviewed": true, "github_reviewed_at": "2025-10-24T19:15:13Z", "nvd_published_at": null, "severity": "MODERATE" }- References
Affected packages
npm / hono
Package
- Name
- hono
- View open source insights on deps.dev
- Purl
- pkg:npm/hono