Vulnerability · Published Jun 30, 2026 · Assigned by VulnCheck

CVE-2025-71381Hono - Vary Header Injection in CORS Middleware

Medium 6.5

In plain English

A medium-severity security flaw in Hono from Hono. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 78.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Hono before 4.10.3 contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response. Because Vary is a response header that should be managed by the server, an attacker can supply arbitrary Vary values that are reflected into the response, potentially causing cache key pollution and inconsistent CORS enforcement in environments that rely on shared caches or proxies.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	hono	4.10.3	GHSA-q7jf-gf43-6x6p

Affected products (as reported)

Vendor	Product	Versions
Hono	Hono	0 – before 4.10.3

Weakness: CWE-113 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-q7jf-gf43-6x6p) vendor-advisory
VulnCheck Advisory: Hono - Vary Header Injection in CORS Middleware third-party-advisory