CVE-2026-69207

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.34

Description The built-in CORS middleware hono/cors contains a regular expression denial of service (ReDoS) flaw. During a preflight OPTIONS request, the middleware parses the Access-Control-Request-Headers header using a whitespace-tolerant regular expression. Due to backtracking, the processing time grows quadratically relative to the input length. An attacker can send a request with a long sequence of whitespace in the header to consume significant CPU resources, potentially blocking request processing and rendering the service unresponsive, especially on runtimes that share a single execution thread across requests. This issue occurs when cors() is used with an unset or empty allowHeaders configuration.

Recommendations Update to version 4.12.34. As a temporary mitigation, configure a non-empty allowHeaders in the cors() middleware to avoid the affected code path.