What’s Vulnerable › Vulnerabilities

CVE-2025-71381: Hono - Vary Header Injection in CORS Middleware

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-30 · updated 2026-10-29
• Weakness: CWE-113

Description

Hono before 4.10.3 contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response. Because Vary is a response header that should be managed by the server, an attacker can supply arbitrary Vary values that are reflected into the response, potentially causing cache key pollution and inconsistent CORS enforcement in environments that rely on shared caches or proxies.

Affected products

• honojs hono: before 4.10.3 — fixed in 4.10.3

How to fix

Upgrade to a fixed version: honojs hono 4.10.3. Check the vendor advisory for mitigations.

References

• https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p
• https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware

Get alerted when CVE-2025-71381 or the next vulnerability affects your stack