7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54290

CVE-2026-54290: hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins. This vulnerability is fixed in 4.12.25.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54290

CVE-2026-54290:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hono	npm	< 4.12.25	4.12.25

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is a CORS misconfiguration in the Hono.js framework where credentialed requests from any origin are allowed. The analysis started by identifying the patched version from the advisory, which is 4.12.25. By comparing the git tags for the patched version (v4.12.25) and the last vulnerable version (v4.12.24), I was able to isolate the commits related to the fix.

Analysis of the commits between these two versions revealed a key change in the CORS middleware file, src/middleware/cors/index.ts, within commit f0b094db8474696344d98e5665a4ac2a6d5f346e. The patch removed a specific block of code inside the cors function. This removed code was responsible for reflecting the request's Origin header in the Access-Control-Allow-Origin response header when credentials was set to true and origin was a wildcard. This directly corresponds to the behavior described in the vulnerability summary. The vulnerable function is therefore the cors middleware factory function itself, as it contained the flawed logic. The fix ensures that a literal '*' is returned, which, in combination with credentials, is correctly rejected by browsers, thus closing the security hole.

Vulnerable functions

cors

src/middleware/cors/index.ts

The `cors` middleware function contained logic that, when configured with `credentials: true` and a wildcard `origin` ('*'), would reflect the value of the `Origin` header from the incoming request into the `Access-Control-Allow-Origin` response header. This behavior violates the CORS specification, which forbids the use of a wildcard origin with credentials. By reflecting any origin, the middleware allowed any third-party website to make credentialed cross-origin requests and read the responses, leading to a cross-site request forgery (CSRF) vulnerability and information disclosure.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.