What is the CVSS score of CVE-2026-54290?

CVE-2026-54290 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Hono are affected by CVE-2026-54290?

Hono web framework versions before 4.12.25 contain a critical vulnerability allowing attackers to steal authentication cookies and session credentials from users through CORS misconfiguration,…. A patch is available.

How to fix or mitigate CVE-2026-54290?

24 hours: Audit all production Hono instances for CORS middleware configuration; immediately restrict allowed origins to explicit domains and disable credentials:true if cross-origin authentication is not required. 7 days: Develop and test deployment plan for Hono version 4.12.25 or later; implement SameSite=Strict on authentication cookies and monitor Hono project repository for patches. 30 days: Complete upgrade of all Hono deployments to version 4.12.25 or later and verify CORS configuration post-deployment.

Hono CVE-2026-54290

EUVD-2026-38329 HIGH

Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)

2026-06-16 https://github.com/honojs/hono

GHSA-88fw-hqm2-52qc

Information Disclosure Cors Misconfiguration

7.1

CVSS 3.1 · Vendor: https://github.com/honojs/hono

Severity by source

Vendor (https://github.com/honojs/hono) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network-reachable via victim's browser (AV:N), trivial to trigger (AC:L), no attacker auth (PR:N), victim must visit malicious page (UI:R), full read of authenticated responses (C:H), limited writes via CSRF-style calls (I:L).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/honojs/hono).

CVSS VectorVendor: https://github.com/honojs/hono

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 16, 2026 - 14:51 vuln.today

Analysis Generated

Jun 16, 2026 - 14:51 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

58 npm packages depend on hono (42 direct, 17 indirect)

Ecosystem-wide dependent count for version 4.12.25.

DescriptionCVE.org

Summary

With credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins.

Details

The spec forbids Access-Control-Allow-Origin: * with credentials and browsers reject it, so this configuration used to fail closed. In affected versions the middleware reflects the request Origin instead, so it now succeeds for every origin, including null. The preflight also echoes the requested headers back, approving non-simple credentialed requests too.

This issue arises when an application enables credentials: true and leaves origin unset or set to the wildcard.

Impact

Any third-party page a logged-in user visits can read the application's cookie-authenticated endpoints and perform credentialed state-changing requests. This affects applications that enable credentialed CORS without restricting origin.

AnalysisAI

Cross-origin credential exposure in Hono web framework versions prior to 4.12.25 allows arbitrary third-party sites to read responses from cookie-authenticated endpoints when applications enable the CORS middleware with credentials: true and leave origin unset. The middleware reflects the request Origin header alongside Access-Control-Allow-Credentials: true, bypassing the browser's standard wildcard-with-credentials safeguard. No public exploit identified at time of analysis, but the misconfiguration pattern is trivial to weaponize and exploitation only requires luring an authenticated user to visit a malicious page.

Technical ContextAI

Hono is a lightweight web framework for JavaScript runtimes (Node.js, Bun, Deno, Cloudflare Workers) distributed as the npm package 'hono'. The vulnerability lives in Hono's CORS middleware. The CORS specification explicitly forbids combining Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true, and browsers reject such responses - historically this caused misconfigured deployments to fail closed. In affected Hono versions, when credentials is enabled and origin defaults to the wildcard, the middleware instead dynamically reflects the incoming Origin header (including the special 'null' origin used by sandboxed iframes and data URIs) and additionally echoes requested headers in preflight responses, approving non-simple credentialed requests. This maps to CWE-942 (Permissive Cross-domain Policy with Untrusted Domains), a classic same-origin policy bypass made possible by overly permissive CORS configuration.

RemediationAI

Vendor-released patch: upgrade hono to version 4.12.25 or later, which restores fail-closed behavior for the credentials + wildcard origin combination - see the GitHub Security Advisory at https://github.com/honojs/hono/security/advisories/GHSA-88fw-hqm2-52qc. If immediate upgrade is not feasible, explicitly configure the CORS middleware's origin option to a specific allowlist (string, array, or validating function) of trusted origins rather than relying on the default; this fully mitigates the issue with the trade-off that any cross-origin frontend not on the allowlist will lose access. Alternatively, set credentials: false if your application does not actually require cookie-authenticated cross-origin requests, which will break any client that depends on sending cookies cross-origin but eliminates the exposure entirely.