CVE-2026-69207 Details
Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in CORS middleware, hono/cors, is vulnerable to a regular expression denial of service (ReDoS). During a preflight OPTIONS request, the middleware parses the attacker-controlled Access-Control-Request-Headers header using a whitespace-tolerant regular expression whose backtracking makes its running time quadratic in the input length. Because the header value is bounded only by the deployment's maximum HTTP header size, a single preflight carrying a long run of whitespace can consume seconds of CPU and block request processing. On runtimes that share one execution thread across requests, this stalls concurrent requests as well, and repeated requests can render the service unresponsive. This affects the default configuration, since the vulnerable path is reached whenever cors() is used with an unset or empty allowHeaders. Applications that set a non-empty allowHeaders are not affected. This issue is fixed in version 4.12.34.
A regular expression denial-of-service (ReDoS) vulnerability has been identified in the Hono web application framework, specifically in the built-in CORS middleware (hono/cors) prior to version 4.12.34. The vulnerability arises during preflight OPTIONS requests, where the middleware parses the Access-Control-Request-Headers header using a whitespace-tolerant regular expression. This regex backtracking creates a quadratic increase in processing time relative to the input length. As a result, a single preflight request with a long whitespace run can consume significant CPU resources, potentially stalling request processing for several seconds. In environments where a single execution thread handles multiple requests, this delay can disrupt concurrent processing, leading to a degraded or unresponsive service. The issue affects applications using the default CORS configuration, which does not specify allowed headers. However, applications that set a non-empty allowHeaders are not vulnerable.
Users are advised to upgrade to Hono version 4.12.34 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 7, 2026CISA-ADP
Assessed Aug 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/honojs/hono/commit/93fc250d8b4df58ea542cb945171de8013d5e6d5 | [email protected] | Source CodeVendor |
| https://github.com/honojs/hono/releases/tag/v4.12.34 | [email protected] | Release NotesVendor |
| https://github.com/honojs/hono/security/advisories/GHSA-8j4g-w8fx-2239 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Hono | < 4.12.34 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2026 | New CVE Received | [email protected] |