CVE-2026-69207

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in CORS middleware, hono/cors, is vulnerable to a regular expression denial of service ReDoS. During a preflight OPTIONS request, the middleware parses the attacker-controlled...

CVE-2026-69207

Hono’s built-in CORS middleware (hono/cors) is vulnerable to a ReDoS in the Access-Control-Request-Headers parsing during preflight requests when allowHeaders is unset/empty. The regex-based parser can backtrack quadratically with long whitespace, potentially causing seconds of CPU usage per pref...