Hono - Vary Header Injection in CORS Middleware

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-71381 · Microsoft / collected KEV context

EUVD-2025-210393

GHSA-cw3j-28qq-x3xh

GHSA-q7jf-gf43-6x6p

cve-program · CVE-2025-71381

• https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p
• https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware

euvd · EUVD-2025-210393

• https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p
• https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware

nvd · CVE-2025-71381

• https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p
• https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware

osv · GHSA-cw3j-28qq-x3xh

• https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p
• https://nvd.nist.gov/vuln/detail/CVE-2025-71381
• https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware

osv · GHSA-q7jf-gf43-6x6p

• https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p
• https://nvd.nist.gov/vuln/detail/CVE-2025-71381
• https://github.com/honojs/hono/commit/d9b8b4b73b4f997994f2764013207365fe711282
• https://github.com/honojs/hono
• https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware

• Hono before 4.10.3 contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response. Because Vary is a response header that should be managed by the… · Advisory content revised · 31 Oct 2026
• Hono before 4.10.3 contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response. Because Vary is a response header that should be managed by the… · Advisory content revised · 30 Oct 2026
• Hono - Vary Header Injection in CORS Middleware · Affected-version evidence changed · 29 Oct 2026