EUVD-2026-54677
GHSA-8j4g-w8fx-2239
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-accessible with no privileges or interaction required; availability rated High because event-loop stalling on single-threaded runtimes causes complete service disruption per request.
Primary rating from Vendor (https://github.com/honojs/hono).
CVSS VectorVendor: https://github.com/honojs/hono
Lifecycle Timeline
2Blast Radius
ecosystem impact- 131 npm packages depend on hono (58 direct, 74 indirect)
Ecosystem-wide dependent count for version 4.12.34.
DescriptionCVE.org
Summary
The built-in CORS middleware (hono/cors) parses the attacker-controlled Access-Control-Request-Headers request header during a preflight (OPTIONS) request using a regular expression whose running time is quadratic in the input length. A single request carrying a long run of whitespace can consume seconds of CPU, and repeated requests can render the service unresponsive. This parsing runs under the default configuration.
Details
On a CORS preflight, when allowHeaders is not configured - the default - the middleware reflects and parses the Access-Control-Request-Headers value. The parser used a whitespace-tolerant regular expression whose backtracking makes the work grow quadratically (O(n²)) with the length of the value when it contains a long whitespace sequence without a delimiter.
Because the header value is bounded only by the deployment's maximum HTTP header size, a single preflight can block request processing for a noticeable amount of time; on runtimes that share one execution thread across requests, this stalls concurrent requests as well. No authentication, special origin, or user interaction is required.
This issue arises for any application using cors() with the default (or an empty) allowHeaders. Applications that set a non-empty allowHeaders do not reach the affected path.
Impact
An unauthenticated attacker can send preflight requests that each consume disproportionate CPU relative to their size, degrading or denying service. This is a denial-of-service issue only; it does not expose or modify data.
AnalysisAI
ReDoS in Hono's built-in CORS middleware allows unauthenticated remote attackers to stall the JavaScript event loop via crafted OPTIONS preflight requests, degrading or denying service to all concurrent users. The affected npm package hono versions below 4.12.34 using the default cors() configuration are vulnerable - no authentication, special origin, or user interaction is required. No CISA KEV listing and no dedicated public exploit tool have been identified at time of analysis, but the attack is trivially reproducible given the fully public advisory and commit diff.
Technical ContextAI
Hono is a lightweight JavaScript/TypeScript web framework targeting edge runtimes including Cloudflare Workers, Deno, Bun, and Node.js. The vulnerable component is the built-in hono/cors middleware (pkg:npm/hono). During CORS preflight handling, when allowHeaders is not configured (the default), the middleware reflects the attacker-controlled Access-Control-Request-Headers header by splitting it with the regular expression /\s*,\s*/. CWE-1333 (Inefficient Regular Expression Complexity) applies: this pattern exhibits catastrophic backtracking when the input contains a long run of whitespace without a comma delimiter, causing O(n²) CPU work relative to input length. Because HTTP header values can reach 8-16 KB depending on server configuration, a single OPTIONS request can stall the JavaScript event loop for seconds. On single-threaded runtimes - Node.js, Deno, Bun, Cloudflare Workers - a blocked event loop freezes all concurrent request processing. The patch (commit 93fc250d8b4df58ea542cb945171de8013d5e6d5) replaces requestHeaders.split(/\s*,\s*/) with the safe equivalent requestHeaders.split(',').map((h) => h.trim()).
RemediationAI
Upgrade to Hono v4.12.34 or later, which is confirmed fixed per the GitHub release tag and commit 93fc250d8b4df58ea542cb945171de8013d5e6d5. The fix is available at https://github.com/honojs/hono/releases/tag/v4.12.34 and documented in the advisory at https://github.com/honojs/hono/security/advisories/GHSA-8j4g-w8fx-2239. If an immediate upgrade is not possible, configure cors() with an explicit non-empty allowHeaders array (e.g., allowHeaders: ['Content-Type', 'Authorization']); this bypasses the vulnerable code path entirely, though it requires auditing your CORS policy to ensure all required headers are listed - unlisted headers will not be reflected. As a defense-in-depth measure, configure the upstream reverse proxy or load balancer to enforce a low maximum size on the Access-Control-Request-Headers header value (e.g., reject values exceeding 512 bytes), which limits per-request CPU consumption without fully remediating the flaw.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today