GHSA-88fw-hqm2-52qc CVE-2026-54290
hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard
- Severity
- 7.1 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.33%
- Chance of exploitation in the next 30 days. Higher than 25.98% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains
- Fix
4.12.25- Upgrade hono to this version or later
Description
Summary
With credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins.
Details
The spec forbids Access-Control-Allow-Origin: * with credentials and browsers reject it, so this configuration used to fail closed. In affected versions the middleware reflects the request Origin instead, so it now succeeds for every origin, including null. The preflight also echoes the requested headers back, approving non-simple credentialed requests too.
This issue arises when an application enables credentials: true and leaves origin unset or set to the wildcard.
Impact
Any third-party page a logged-in user visits can read the application's cookie-authenticated endpoints and perform credentialed state-changing requests. This affects applications that enable credentialed CORS without restricting origin.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| hono | < 4.12.25 |
4.12.25 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
hono npm → 4.12.25
- npm
npm install hono@4.12.25- yarn
yarn add hono@4.12.25- pnpm
pnpm add hono@4.12.25
Severity breakdown
CVSS 3.1 7.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Weakness
CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains
The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
How to prevent it
- Architecture and Design, Operation: Define a restrictive Content Security Policy [REF-1486] or cross-domain policy file.
- Architecture and Design, Operation: Avoid using wildcards in the CSP / cross-domain policy file. Any domain matching the wildcard expression will be implicitly trusted, and can perform two-way interaction with the target server.
- Architecture and Design, Operation: For Flash, modify crossdomain.xml to use meta-policy options such as 'master-only' or 'none' to reduce the possibility of an attacker planting extraneous cross-domain policy files on a server.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-5r4p-p66f-jhc7 Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths | Medium | Also affects hono |
| GHSA-hxh3-vqpv-xpqv hono/jsx renders plain strings unescaped in boundary components, leading to XSS | Low | Also affects hono |
| GHSA-gqvv-2mrq-wpjv Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory | Medium | Also affects hono |
| GHSA-g6gw-c38x-mqfc Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion | Medium | Also affects hono |
| GHSA-crvj-82cr-hjcx Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials | Medium | Also affects hono |
| GHSA-f23p-vx2j-j53r Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure | Medium | Also affects hono |
| GHSA-79qm-7rj5-m7r9 Hono: Proxy Helper does not remove response headers listed in the `Connection` header | Low | Also affects hono |
| GHSA-54fx-42gc-7vw4 Hono: Algorithmic Complexity DoS in Language Middleware | Medium | Also affects hono |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor