CVE-2025-71381

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.10.3

Description A flaw exists in the CORS middleware when the origin is not set to "*". The middleware copies the Vary header from the incoming request directly into the response. Since the Vary header is a response header that should be managed by the server, an attacker can provide arbitrary values that are reflected in the response. This can lead to cache key pollution—a condition where a cache is tricked into storing multiple versions of a resource under different keys—and inconsistent CORS enforcement in environments using shared caches or proxies.

Recommendations Update Hono to version 4.10.3.