{"id":"EUVD-2026-30036","enisaUuid":"2c4b3580-9b98-3111-ad53-dc4b1277ea50","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Vary: Authorization or Vary: Cookie. As a result, a response cached for one authenticated user may be served to subsequent requests from different users. This vulnerability is fixed in 4.12.18.","datePublished":"May 13, 2026, 2:58:52 PM","dateUpdated":"May 18, 2026, 2:07:53 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-p77w-8qqv-26rm\n","aliases":"CVE-2026-44457\nGHSA-p77w-8qqv-26rm\n","assigner":"GitHub_M","epss":0.2,"enisaIdProduct":[{"id":"b441c3fe-7f84-3a60-9859-70e2dd894583","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"\u003c 4.12.18"}],"enisaIdVendor":[{"id":"64478595-ef46-3947-a607-f643a2542e20","vendor":{"name":"honojs"}}],"enisaIdVulnerability":[{"id":"83927c00-dd30-31e6-a616-a93daf145d75","vulnerability":{"id":"GHSA-p77w-8qqv-26rm","description":"Hono\u0027s Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage","datePublished":"May 9, 2026, 12:28:46 AM","dateUpdated":"May 14, 2026, 8:35:40 PM","baseScore":0.0,"references":"https://github.com/honojs/hono/security/advisories/GHSA-p77w-8qqv-26rm\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44457\nhttps://github.com/honojs/hono\n","enisa_id":"EUVD-2026-30036\n","aliases":"GHSA-p77w-8qqv-26rm\nCVE-2026-44457\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"8a7f5782-a32a-3399-b94c-e1f13c4bbf70","vulnerability":{"id":"CVE-2026-44457","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Vary: Authorization or Vary: Cookie. As a result, a response cached for one authenticated user may be served to subsequent requests from different users. This vulnerability is fixed in 4.12.18.","datePublished":"May 13, 2026, 2:58:52 PM","dateUpdated":"May 18, 2026, 2:07:53 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-p77w-8qqv-26rm\n","enisa_id":"EUVD-2026-30036\n","assigner":"GitHub_M","epss":0.2,"dataProcessed":"Oct 28, 2026, 7:17:27 AM","vulnerabilityProduct":[{"id":"0c794d9f-f2ad-382c-bc90-1cde739d98a3","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"\u003c 4.12.18"}],"vulnerabilityVendor":[{"id":"bff1c305-45fa-397c-bb02-b0ffe6a604f0","vendor":{"name":"honojs"}}]}}],"enisaIdAdvisory":[]}