CVE-2025-71381: Hono CORS Middleware Vary Header Injection – Cache Pollution Risk

Technical summary

CVE-2025-71381 is a header injection vulnerability in Hono's CORS middleware implementation. The flaw occurs because the middleware copies the incoming request's Vary header directly into the response when CORS origin is not set to "*". Since Vary is a response header that should only be set by the server to signal cache key variance to intermediaries, reflecting attacker-controlled input violates HTTP semantics and cache security assumptions. An attacker can inject multiple Vary values to cause cache key pollution—making a single response be stored under multiple cache keys, or triggering revalidation behavior that breaks CORS enforcement in downstream proxies. The vulnerability is classified as CWE-113 (Improper Neutralization of HTTP Headers), a well-known category of header injection flaws.

Business impact

For organizations running Hono-based APIs, this vulnerability can degrade cache efficiency and create security blind spots in proxy or CDN layers. If an attacker poisons the Vary header in requests to an API, shared caches may serve cached responses to incorrect consumers or fail to enforce CORS policies consistently, potentially exposing data to unintended origins. In microservice architectures relying on transparent proxy caching, this can also trigger unexpected cache behavior, leading to service availability issues or inconsistent authentication/authorization checks across regions.

Affected systems

Hono versions prior to 4.10.3 are affected. The vulnerability specifically manifests in deployments where: (1) the CORS middleware is active with origin values other than "*", and (2) shared caches, CDNs, or HTTP proxies sit between clients and the application. Standalone or edge-cached deployments using Hono are at higher risk than single-instance applications. Organizations using recent versions of Hono (4.10.3 or later) are unaffected.

Exploitability

Exploitability is straightforward and does not require authentication or elevated privileges. An attacker simply crafts HTTP requests with malicious Vary header values and sends them to a Hono application protected by CORS middleware. The attacker gains influence over cache behavior in any shared cache or proxy between the application and clients. The attack becomes more potent in environments with multiple origin policies or complex proxy chains, where cache key variance can be weaponized to serve stale or incorrect responses. No complex timing, race conditions, or user interaction is necessary.

Remediation

Upgrade Hono to version 4.10.3 or later. This version fixes the CORS middleware to properly sanitize and manage the Vary header according to HTTP semantics, preventing reflection of attacker-supplied values. After upgrading, clear any cached responses that may have been poisoned by the vulnerability, particularly in CDN or proxy layers that serve multiple origins.

Patch guidance

Update your Hono dependency to 4.10.3 or newer in your package.json or lock file. Run your package manager's update command (e.g., npm update hono, yarn upgrade hono, or pnpm update hono) and verify the installed version matches or exceeds 4.10.3. Test your CORS configuration in a staging environment before deploying to production. Consult the Hono release notes or security advisory for any breaking changes or additional configuration recommendations.

Detection guidance

Monitor HTTP traffic for requests containing multiple or unusual Vary header values directed at your Hono endpoints. Enable logging of response headers, particularly the Vary header, to detect when unexpected values are reflected back. In proxy or CDN logs, look for cache key mismatches or unexplained cache behavior correlated with requests containing modified Vary headers. Security scanners can be configured to inject test Vary headers and verify they are not echoed in responses. Baseline your normal Vary header values and alert on deviations.

Why prioritize this

Although the CVSS score is moderate (6.5), this vulnerability should be prioritized because: (1) it requires no user interaction or authentication to exploit, (2) it directly affects cache infrastructure, which is often overlooked in patch cycles, (3) the impact compounds in complex proxy architectures, and (4) header injection flaws are notoriously difficult to detect once exploited. Organizations running Hono in cloud-native or edge-computing scenarios should patch immediately.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects a network-accessible vulnerability with low complexity and no authentication requirement, but limited scope and no direct confidentiality or availability impact. However, the score does not fully capture the cascade risk in shared-cache environments. The integrity impact (I:L) accounts for potential cache pollution; the confidentiality impact (C:L) reflects possible information leakage via cache key poisoning. The lack of availability impact (A:N) is conservative, as cache thrashing could degrade performance. Organizations with complex proxy topologies may wish to treat this as higher-priority than the base score suggests.

Frequently asked questions