CVE-2025-71381
Hono before 4.10.2 (fixed in 4.10.3) contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response. Because Vary is a response header that should be managed by the server, an attacker can supply arbitrary Vary values that are reflected into the response, potentially causing cache key pollution and inconsistent CORS enforcement in environments that rely on shared caches or proxies.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.29%
- CWE
- CWE-113
- Published
- 2026-06-30
- Last modified
- 2026-07-01
Affected products
- Hono Hono
- Hono Hono
Weakness type
Related vulnerabilities
- CVE-2026-77341 — cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing
- CVE-2026-39915 — TIM Flow < 26.0.6 CRLF Injection via rt Parameter
- CVE-2026-50576 — ePA 3.x Integration: HTTP Header Injection in VAU Inner Requests
- CVE-2026-67289 — FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
- CVE-2026-66746 — Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection
- CVE-2026-66753 — tiny-http 0.12.0 HTTP Response Splitting via Header Injection
- CVE-2026-63771 — Adminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix Header
- CVE-2026-54163 — secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input