Hono Cache Middleware CVE-2026-44457

The vulnerability requires two specific conditions to manifest: first, the application must use Hono's Cache Middleware on an endpoint that returns user-specific data; second, the response must declare variance via Vary: Authorization or Vary: Cookie headers but must not set Cache-Control: private (or other cache-control directives that already cause the middleware to skip caching). If Cache-Control: private is present, the middleware already skips caching regardless of this vulnerability. The vulnerability is limited to HTTP caching contexts where the middleware is active; endpoints without caching configuration are not affected. Additionally, the vulnerability only leaks data to subsequent different users making requests to the same endpoint within the cache TTL window - it does not enable cross-endpoint data disclosure. Non-default configurations that implement reverse proxies or additional caching layers may further constrain or expand the exposure.

This vulnerability presents moderate real-world risk despite a moderate CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L). The CVSS vector indicates network-accessible, low-complexity exploitation without authentication or user interaction, suggesting broad exposure. However, real-world impact depends critically on application behavior: the vulnerability only materializes when developers rely solely on Vary: Authorization or Vary: Cookie without also setting Cache-Control: private, which violates defense-in-depth caching practices. The information disclosure is limited to cached response bodies (Confidentiality:Low per CVSS), not code execution or availability impact. Exploitation is deterministic and not probabilistic - if an application meets the vulnerable conditions, any attacker can receive cached user data by making sequential requests. No EPSS score, POC status, or KEV listing is provided in the input data, preventing comparison of real-world exploitation signals. The vulnerability is not an authentication bypass but rather a caching logic flaw affecting applications that incorrectly assume Vary headers alone secure user-specific data. Priority should be elevated for applications serving sensitive user data (PII, financial records, medical information) via REST APIs, and reduced for those serving public or non-sensitive cached content.

An attacker makes a request to a vulnerable Hono endpoint that returns user-specific data (e.g., /api/user/profile with Bearer token for User A). The response includes Vary: Authorization but not Cache-Control: private, causing it to be cached by the middleware. The attacker then makes a second request to the same endpoint with a different Bearer token for User B (or without authentication, depending on endpoint design). The middleware serves the cached response from User A's original request, disclosing User A's profile data to the attacker.