MEDIUM 5.3 GitHub
CVE-2026-69207
Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
### Summary
The built-in CORS middleware (`hono/cors`) parses the attacker-controlled `Access-Control-Request-Headers` request header during a preflight (`OPTIONS`) request using a regular expression whose running time is quadratic in the input length. A single request carrying a long run of whitespace can consume seconds of CPU, and repeated requests can render the service unresponsive. This parsing runs under the default configuration.
### Details
On a CORS preflight, when `allowHeaders` is
Affected Products
- npm/hono < 4.12.34
References
- https://github.com/advisories/GHSA-8j4g-w8fx-2239
- https://github.com/honojs/hono/security/advisories/GHSA-8j4g-w8fx-2239
- https://github.com/honojs/hono/commit/93fc250d8b4df58ea542cb945171de8013d5e6d5
- https://github.com/honojs/hono/releases/tag/v4.12.34
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-08-03 via GitHub. Affected: npm/hono < 4.12.34.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.