CVE-2026-69207

Received Received - Intake

ReDoS Vulnerability in Hono CORS Middleware

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in CORS middleware, hono/cors, is vulnerable to a regular expression denial of service (ReDoS). During a preflight OPTIONS request, the middleware parses the attacker-controlled Access-Control-Request-Headers header using a whitespace-tolerant regular expression whose backtracking makes its running time quadratic in the input length. Because the header value is bounded only by the deployment's maximum HTTP header size, a single preflight carrying a long run of whitespace can consume seconds of CPU and block request processing. On runtimes that share one execution thread across requests, this stalls concurrent requests as well, and repeated requests can render the service unresponsive. This affects the default configuration, since the vulnerable path is reached whenever cors() is used with an unset or empty allowHeaders. Applications that set a non-empty allowHeaders are not affected. This issue is fixed in version 4.12.34.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-69207

Affected Vendors & Products

Vendor	Product	Version / Range
hono	hono	to 4.12.34 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

Executive Summary

This vulnerability is a regular expression denial of service (ReDoS) in Hono's built-in CORS middleware (hono/cors) before version 4.12.34. It occurs during preflight OPTIONS requests when the middleware processes the Access-Control-Request-Headers header using a flawed regular expression. The regex's backtracking behavior causes quadratic time complexity relative to input length, allowing attackers to consume excessive CPU by sending a long string of whitespace in the header.

Detection Guidance

To detect this vulnerability, monitor for unusually high CPU usage during OPTIONS requests. Check if the hono/cors middleware is running a version prior to 4.12.34. Inspect logs for repeated preflight requests with long whitespace in the Access-Control-Request-Headers header.

Impact Analysis

This vulnerability can cause service slowdowns or complete unresponsiveness. A single malicious request with a long whitespace string in the Access-Control-Request-Headers header can block request processing for seconds. On single-threaded runtimes, this stalls all concurrent requests, potentially making the service unavailable. Repeated attacks could render the service unresponsive.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by causing service disruptions due to CPU exhaustion from ReDoS attacks. Downtime or degraded performance may violate availability requirements in these standards.

Mitigation Strategies

Upgrade Hono to version 4.12.34 or later. If upgrading is not immediately possible, disable the hono/cors middleware or configure allowHeaders to a non-empty value to avoid the vulnerable path. Monitor network traffic for suspicious OPTIONS requests.

Hi! I’m here to help you understand CVE-2026-69207. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70