GHSA-q7jf-gf43-6x6p: Hono vulnerable to Vary Header Injection leading to potential CORS Bypass
6.5
CVSS Score
3.1
Basic Information
CVE ID
-
GHSA ID
EPSS Score
-
CWE
Published
10/24/2025
Updated
10/24/2025
KEV Status
No
Technology
JavaScript
JavaScriptTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| hono | npm | < 4.10.3 | 4.10.3 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability lies within the cors middleware of the Hono framework. The provided patch d9b8b4b73b4f997994f2764013207365fe711282 clearly shows the removal of code that was responsible for this behavior. Specifically, the lines that read the Vary header from the request (c.req.header('Vary')) and then set it on the response have been removed. The fix involves correctly setting the Vary header to Origin on the response, and appending it if the header already exists, which is the correct behavior for a CORS middleware. The vulnerable function is therefore the main cors function itself, as it contained the flawed logic.
Vulnerable functions
corssrc/middleware/cors/index.ts
The `cors` middleware function was vulnerable because it would reflect the `Vary` header from the incoming request to the response headers. An attacker could send a request with a crafted `Vary` header, which would then be present in the response. This could lead to cache poisoning or other cache-related issues, as well as potential CORS bypasses depending on the caching infrastructure.