---
id: CVE-2026-54290
aliases:
  - GHSA-88fw-hqm2-52qc
title: >-
  hono: CORS Middleware reflects any Origin with credentials when `origin`
  defaults to the wildcard
summary: >-
  hono: CORS Middleware reflects any Origin with credentials when `origin`
  defaults to the wildcard
severity: high
cvss: 7.1
cwe:
  - CWE-942
vendor: hono
product: hono
ecosystem: npm
affected:
  - hono < 4.12.25
patched:
  - hono 4.12.25
published: '2026-06-16'
updated: '2026-06-16'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-88fw-hqm2-52qc'
references:
  - url: 'https://github.com/honojs/hono/security/advisories/GHSA-88fw-hqm2-52qc'
  - url: 'https://github.com/advisories/GHSA-88fw-hqm2-52qc'
tags:
  - ghsa
  - npm
epss: 0.00328
epssPercentile: 0.23172
ingestedAt: '2026-07-07T15:41:58.357Z'
---

## Overview

### Summary

With `credentials: true` and no explicit `origin` (the default wildcard), the CORS Middleware reflects the request's `Origin` and sends `Access-Control-Allow-Credentials: true`. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins.

### Details

The spec forbids `Access-Control-Allow-Origin: *` with credentials and browsers reject it, so this configuration used to fail closed. In affected versions the middleware reflects the request `Origin` instead, so it now succeeds for every origin, including `null`. The preflight also echoes the requested headers back, approving non-simple credentialed requests too.

This issue arises when an application enables `credentials: true` and leaves `origin` unset or set to the wildcard.

### Impact

Any third-party page a logged-in user visits can read the application's cookie-authenticated endpoints and perform credentialed state-changing requests. This affects applications that enable credentialed CORS without restricting `origin`.

## Affected packages

- `hono < 4.12.25`

## Remediation

Upgrade to a patched release:

- `hono 4.12.25`