Inefficient regular expression complexity in hono - #VU140825
Published: August 3, 2026
Vulnerability identifier: #VU140825
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient regular expression complexity in the built-in CORS middleware when processing the Access-Control-Request-Headers header during a CORS preflight request. A remote attacker can send a specially crafted OPTIONS request with a long whitespace sequence in the header value to cause a denial of service.
Only applications using cors() with the default or an empty allowHeaders setting reach the affected code path.
Affected software
hono
Remediation
Install security update from vendor's website.
hono - update to 4.12.34