---
id: GHSA-cw3j-28qq-x3xh
title: >-
  Duplicate Advisory: Hono vulnerable to Vary Header Injection leading to
  potential CORS Bypass
summary: >-
  Duplicate Advisory: Hono vulnerable to Vary Header Injection leading to
  potential CORS Bypass
severity: medium
cvss: 6.5
cwe:
  - CWE-113
vendor: hono
product: hono
ecosystem: npm
affected:
  - hono < 4.10.3
published: '2026-07-01'
updated: '2026-10-02'
sourceUpdated: '2026-10-02T18:28:40Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-cw3j-28qq-x3xh'
references:
  - url: 'https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-71381'
  - url: >-
      https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware
  - url: 'https://github.com/advisories/GHSA-cw3j-28qq-x3xh'
tags:
  - ghsa
  - npm
ingestedAt: '2026-10-02T22:33:09.858Z'
---

## Overview

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-q7jf-gf43-6x6p. This link is maintained to preserve external references.

## Original Description
Hono before 4.10.2 (fixed in 4.10.3) contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response. Because Vary is a response header that should be managed by the server, an attacker can supply arbitrary Vary values that are reflected into the response, potentially causing cache key pollution and inconsistent CORS enforcement in environments that rely on shared caches or proxies.

## Affected packages

- `hono < 4.10.3`

## Remediation

Refer to the advisory for the patched release.