The Hono CORS middleware (hono/cors) parses the Access-Control-Request-Headers header during preflight OPTIONS requests using a regular expression that exhibits quadratic time complexity (O(n²)) when processing long sequences of whitespace. This occurs when the allowHeaders option is unset or empty, which is the default configuration. An attacker can exploit this by sending a single preflight request with a long whitespace run in the header, causing significant CPU consumption and potentially stalling the service, especially on runtimes with single-threaded execution. This vulnerability leads to denial of service by resource exhaustion without requiring authentication or user interaction. Applications that explicitly set a non-empty allowHeaders value are not affected. The issue affects Hono versions prior to 4.12.34 and has a CVSS 3.1 score of 5.3 (medium severity). A patch is available.

An unauthenticated attacker can cause denial of service by sending specially crafted CORS preflight requests with long whitespace sequences in the Access-Control-Request-Headers header. This triggers a regular expression with quadratic runtime, consuming excessive CPU and potentially making the service unresponsive. The vulnerability affects availability only; it does not compromise confidentiality or integrity of data.

A patch is available for Hono versions prior to 4.12.34. Users should upgrade to version 4.12.34 or later to resolve this issue. Alternatively, configuring the CORS middleware with a non-empty allowHeaders option prevents the vulnerable code path from being executed. No other mitigation is required.