CVE-2026-69207 Hono: ReDoS in CORS middleware via Access-Control-Request-Headers

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in CORS middleware, hono/cors, is vulnerable to a regular expression denial of service ReDoS. During a preflight OPTIONS request, the middleware parses the attacker-controlled...

Regular Expression Denial of Service (ReDoS)

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the cors middleware during the parsing of the Access-Control-Request-Headers header via a regular expression with quadratic runtime complexit...

NPM: Hono: ReDoS in CORS middleware via Access-Control-Request-Headers

NPM: Hono: ReDoS in CORS middleware via Access-Control-Request-Headers vulnerability discovered by ? in WordPress Npm hono versions 4.12.34...