CVE-2026-69207

Hono’s built-in CORS middleware (hono/cors) is vulnerable to a ReDoS in the Access-Control-Request-Headers parsing during preflight requests when allowHeaders is unset/empty. The regex-based parser can backtrack quadratically with long whitespace, potentially causing seconds of CPU usage per pref...

CVE-2026-69207: Inefficient Regular Expression Complexity

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in CORS middleware, hono/cors, is vulnerable to a regular expression denial of service ReDoS. During a preflight OPTIONS request, the middleware parses the attacker-controlled...

Regular Expression Denial of Service (ReDoS)

Overview org.webjars.npm:hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the cors middleware during the parsing of the Access-Control-Request-Headers header via a regular expression with quadratic...

GHSA-8J4G-W8FX-2239 Hono: ReDoS in CORS middleware via Access-Control-Request-Headers

Summary The built-in CORS middleware hono/cors parses the attacker-controlled Access-Control-Request-Headers request header during a preflight OPTIONS request using a regular expression whose running time is quadratic in the input length. A single request carrying a long run of whitespace can...

EUVD-2025-23882

Malicious code in bioql PyPI...

GHSA-VH9X-PHQ6-FX54 Duplicate Advisory: Denial of service via malicious preflight requests in github.com/rs/cors

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mh55-gqvf-xfwm. This link is maintained to preserve external references. Original Description Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include ...

CVE-2025-47908

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers ACRH header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt...

UBUNTU-CVE-2025-47908

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers ACRH header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt...

CVE-2025-47908

The github.com/rs/cors middleware is vulnerable to a denial of service due to a prohibitive amount of heap allocations when processing malicious preflight requests. Attackers can exploit this by providing an Access-Control-Request-Headers (ACRH) header containing a value with many commas, causing...

CVE-2025-47908 Denial of service via malicious preflight requests in github.com/rs/cors

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers ACRH header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt...

CVE-2025-47908 Denial of service via malicious preflight requests in github.com/rs/cors

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers ACRH header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt...

CVE-2025-47908 Denial of service via malicious preflight requests in github.com/rs/cors

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers ACRH header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt...

CVE-2025-47908: Undefined Security Weakness

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers ACRH header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt...

Denial of service via malicious preflight requests in github.com/rs/cors

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers ACRH header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt...

PT-2025-32214

Name of the Vulnerable Software and Affected Versions Middleware affected versions not specified Description The middleware experiences excessive heap allocations when handling malicious preflight requests containing a large number of commas within the Access-Control-Request-Headers ACRH header...