{"cve":"CVE-2025-71381","nvd":{"published":"2026-06-30T23:16:52.027","modified":"2026-10-12T21:10:00.227","status":"Deferred","description":"Hono before 4.10.2 (fixed in 4.10.3) contains a flaw in its CORS middleware: when the origin is not set to \"*\", the middleware copies the Vary header from the incoming request into the response. Because Vary is a response header that should be managed by the server, an attacker can supply arbitrary Vary values that are reflected into the response, potentially causing cache key pollution and inconsistent CORS enforcement in environments that rely on shared caches or proxies.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":6.9},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5},"cwes":["CWE-113"],"references":["https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:41:17.107060303+00:00"},"epss":{"cve":"CVE-2025-71381","score":0.00292,"percentile":0.21565,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-q7jf-gf43-6x6p","url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","summary":"Hono vulnerable to Vary Header Injection leading to potential CORS Bypass","modified":"2026-10-02T18:45:04.883415459Z","packages":[{"ecosystem":"npm","name":"hono","purl":"pkg:npm/hono","ranges":["<4.10.3"],"fixed":["4.10.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}