CVE-2025-71381

[CVE catalog]

Severity

Medium · CVSS 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Jan 1, 2025, 12:00:00 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.29% · Oct 25, 2026

A flaw was found in Hono's Cross-Origin Resource Sharing (CORS) middleware. When the origin is not set to a wildcard, the middleware improperly copies the Vary header from incoming requests into the response. This allows an attacker to inject arbitrary Vary values, potentially leading to cache key pollution and inconsistent CORS enforcement. Such an issue can affect environments that rely on shared caches or proxies, potentially enabling a bypass of CORS policies. Hono: Hono: Potential CORS bypass via Vary Header Injection Red Hat products that include the Hono npm package already ship version 4.11.4 or later, which contains the fix for this vulnerability. No Red Hat products are affected. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.