CVE-2025-71381

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-71381
Hono before 4.10.3 contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response. Because Vary is a response header that should be managed by the server, an attacker can supply arbitrary Vary values that are reflected into the response, potentially causing cache key pollution and inconsistent CORS enforcement in environments that rely on shared caches or proxies.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p
https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware
Configurations

No configuration.

History

29 Oct 2026, 21:17

Type Values Removed Values Added
Summary (en) Hono before 4.10.2 (fixed in 4.10.3) contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response. Because Vary is a response header that should be managed by the server, an attacker can supply arbitrary Vary values that are reflected into the response, potentially causing cache key pollution and inconsistent CORS enforcement in environments that rely on shared caches or proxies. (en) Hono before 4.10.3 contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response. Because Vary is a response header that should be managed by the server, an attacker can supply arbitrary Vary values that are reflected into the response, potentially causing cache key pollution and inconsistent CORS enforcement in environments that rely on shared caches or proxies.

05 Oct 2026, 16:10

Type Values Removed Values Added
Summary
  • (es) Hono anterior a 4.10.2 (corregido en 4.10.3) contiene una vulnerabilidad en su middleware CORS: cuando el origen no está configurado como '*', el middleware copia el encabezado Vary de la solicitud entrante a la respuesta. Debido a que Vary es un encabezado de respuesta que debería ser gestionado por el servidor, un atacante puede proporcionar valores Vary arbitrarios que se reflejan en la respuesta, lo que podría causar contaminación de la clave de caché y una aplicación inconsistente de CORS en entornos que dependen de cachés compartidas o proxies.
Information

Published : 2026-06-30 23:16

Updated : 2026-10-29 21:17

NVD link : CVE-2025-71381

Mitre link : CVE-2025-71381

CVE.ORG link : CVE-2025-71381

JSON object : View

Products Affected

No product.

CWE
CWE-113

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')