Hono CVE-2025-71381

Exploitation requires two specific conditions: (1) the Hono application must have the CORS middleware enabled with the origin configuration set to a specific origin value - NOT the wildcard *; applications using origin: '*' are not affected as this code path is bypassed. (2) The application must be deployed behind a shared cache, CDN, or reverse proxy that uses the Vary header for cache keying - without a caching intermediary, cache key pollution has no downstream effect and the practical impact is negligible. The CVSS 4.0 vector confirms unauthenticated remote access (PR:N, UI:N) with no additional attack requirements (AT:N), meaning no special session, account, or configuration access is needed beyond being able to send HTTP requests to the target. Exploitation is limited to non-wildcard CORS deployments with caching infrastructure; direct-origin Hono applications without caching layers face minimal real-world risk.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N reflects a remotely exploitable, low-complexity flaw requiring no privileges or user interaction, with limited confidentiality and integrity impact. The real-world risk is conditional and context-dependent: exploitation is only meaningful in deployments that sit behind shared caches, CDNs, or caching proxies - direct origin servers with no caching layer are substantially less exposed. Integrity impact (VI:L) materializes as cache poisoning that causes wrong CORS enforcement for other users, while the confidentiality impact (VC:L) is limited to information leakage via cache probing. No EPSS score was provided in the input data, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. No POC has been identified at time of analysis. For edge-deployed Hono applications behind CDNs (the primary Hono use case), this is a realistic, if moderate-severity, threat. For direct-origin deployments without caching intermediaries, the practical risk is low despite the network-accessible attack vector.

An attacker targeting a Hono application deployed behind a shared CDN sends a crafted HTTP request containing a manipulated Vary: X-Attacker-Header value. The Hono CORS middleware - configured with a specific origin rather than wildcard - copies this attacker-supplied value into the response's Vary header. The CDN caches this response keyed on the attacker-injected header, causing legitimate subsequent users to receive CORS-incorrect cached responses, potentially bypassing or mis-enforcing origin restrictions. No public exploit code is identified at time of analysis, but the technique requires only standard HTTP request crafting.