Threat Intelligence Database

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hono framework's built-in CORS middleware (hono/cors) when using the default configuration. The middleware parses the Access-Control-Request-Headers header during CORS preflight OPTIONS requests using a regex with quadratic time complexity on input length. An attacker can send crafted preflight requests with long whitespace sequences to consume excessive CPU, causing service degradation or denial of service. This affects versions of Hono prior to 4.12.34. No authentication or special origin is required, and the issue only impacts availability without exposing or modifying data.

A race condition vulnerability (CWE-362) exists in the honojs hono framework versions from 4.11.8 up to but not including 4.12.27. The issue arises because hono/jsx did not isolate context values per request during server-side rendering, allowing context data from a different in-flight request to be accessed after an await in an async component. This vulnerability has a CVSS score of 6.5 (medium severity) and is fixed in version 4.12.27.

A cross-site scripting (XSS) vulnerability exists in honojs hono versions from 4.0.0 up to but not including 4.12.27. The cx() function in hono/css composes class names from plain strings but marks them as already escaped without properly HTML-escaping input. This allows untrusted className values used in JSX class attributes during server-side rendering to inject arbitrary markup. The issue is fixed in version 4.12.27.