Hono before version 4.10.3 contains a flaw in its CORS middleware. When the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response. Since the Vary header is a response header that should be controlled by the server, this behavior allows an attacker to supply arbitrary Vary header values that are reflected in the response. This can lead to cache key pollution and inconsistent enforcement of CORS policies in environments that use shared caches or proxies. The vulnerability is addressed by a fix in version 4.10.3.

The vulnerability can cause cache key pollution and inconsistent CORS enforcement, which may lead to unauthorized cross-origin resource sharing in environments relying on shared caches or proxies. This could potentially allow attackers to bypass CORS restrictions, leading to limited confidentiality and integrity impacts as indicated by the CVSS vector (C:L/I:L/A:N).

Upgrade Hono to version 4.10.3 or later, where this vulnerability is fixed. No other specific mitigations are indicated. Patch status is confirmed by the original advisory stating the fix is in 4.10.3.