CVE-2025-71381Medium· 6.5▾ SunlitHono before 4.10.2 (fixed in 4.10.3) contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response. Because Vary is a response header that sho…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
4.2 → 6.5
Last analysed / modified upstream
Hono before 4.10.2 (fixed in 4.10.3) contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response. Because Vary is a response header that should be managed by the server, an attacker can supply arbitrary Vary values that are reflected into the response, potentially causing cache key pollution and inconsistent CORS enforcement in environments that rely on shared caches or proxies.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
hono < 4.10.3Patched in:
hono 4.10.3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
GHSA-cw3j-28qq-x3xhMedium· 6.5Duplicate Advisory: Hono vulnerable to Vary Header Injection leading to potential CORS Bypass
GHSA-55cm-p4ww-685gMedium· 5.3Duplicate Advisory: Hono missing validation of cookie name on write path in setCookie()
CVE-2026-56762Medium· 5.3Hono missing validation of cookie name on write path in setCookie()
CVE-2026-84363Medium· 5.9Hono is a Web application framework that provides support for any JavaScript runtime
CVE-2026-47676Medium· 5.3Hono is a Web application framework that provides support for any JavaScript runtime
CVE-2026-47675Medium· 4.3Hono is a Web application framework that provides support for any JavaScript runtime