The honojs hono web application framework's built-in CORS middleware (hono/cors) prior to version 4.12.34 is vulnerable to a regular expression denial of service (ReDoS) due to inefficient regular expression complexity (CWE-1333). Specifically, during a preflight OPTIONS request, the middleware parses the Access-Control-Request-Headers header using a whitespace-tolerant regular expression that exhibits quadratic backtracking behavior relative to input length. Since the header length is only limited by the maximum HTTP header size, an attacker can craft a header with a long whitespace sequence to cause significant CPU consumption, stalling request processing and potentially rendering the service unresponsive on single-threaded runtimes. This vulnerability affects default configurations where allowHeaders is unset or empty, but not configurations with a non-empty allowHeaders. The issue is resolved in version 4.12.34.

The vulnerability allows an attacker to cause a denial of service by sending a specially crafted preflight OPTIONS request with a long whitespace sequence in the Access-Control-Request-Headers header. This can consume excessive CPU resources and block request processing, potentially stalling concurrent requests on runtimes that share a single execution thread. The impact is limited to availability (denial of service) with no confidentiality or integrity impact reported.

Upgrade to hono version 4.12.34 or later, where this issue is fixed. Alternatively, configure the CORS middleware with a non-empty allowHeaders setting to avoid the vulnerable code path. No other mitigations are indicated by the vendor advisory.