CVE-2026-44457

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Vary: Authorization or Vary: Cookie. As a result, a response cached for one authenticated user may be served to subsequent requests from different users. This vulnerability is fixed in 4.12.18.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/honojs/hono/security/advisories/GHSA-p77w-8qqv-26rm	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hono:hono:*:*:*:*:*:node.js:*:*

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Hono es un framework de aplicación web que proporciona soporte para cualquier entorno de ejecución de JavaScript. Antes de la 4.12.18, el Middleware de caché no omite el almacenamiento en caché para las respuestas que declaran varianza por usuario a través de Vary: Authorization o Vary: Cookie. Como resultado, una respuesta almacenada en caché para un usuario autenticado puede ser entregada a solicitudes posteriores de diferentes usuarios. Esta vulnerabilidad está corregida en la 4.12.18.

Information

Published : 2026-05-13 16:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-44457

Mitre link : CVE-2026-44457

CVE.ORG link : CVE-2026-44457

JSON object : View

Products Affected

hono

hono

CWE

CWE-524

Use of Cache Containing Sensitive Information

{"id": "CVE-2026-44457", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44457", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-18T14:06:33.297435Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "honojs", "product": "hono", "versions": [{"status": "affected", "version": "< 4.12.18"}]}]}], "published": "2026-05-13T16:16:57.700", "references": [{"url": "https://github.com/honojs/hono/security/advisories/GHSA-p77w-8qqv-26rm", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-524"}]}], "descriptions": [{"lang": "en", "value": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Vary: Authorization or Vary: Cookie. As a result, a response cached for one authenticated user may be served to subsequent requests from different users. This vulnerability is fixed in 4.12.18."}, {"lang": "es", "value": "Hono es un framework de aplicaci\u00f3n web que proporciona soporte para cualquier entorno de ejecuci\u00f3n de JavaScript. Antes de la 4.12.18, el Middleware de cach\u00e9 no omite el almacenamiento en cach\u00e9 para las respuestas que declaran varianza por usuario a trav\u00e9s de Vary: Authorization o Vary: Cookie. Como resultado, una respuesta almacenada en cach\u00e9 para un usuario autenticado puede ser entregada a solicitudes posteriores de diferentes usuarios. Esta vulnerabilidad est\u00e1 corregida en la 4.12.18."}], "lastModified": "2026-10-26T14:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hono:hono:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "5AB1A6FC-8475-4A23-9E63-46F3E6C5D264", "versionEndExcluding": "4.12.18"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}