Is CVE-2025-71381 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-71381 being exploited in the wild.

How severe is CVE-2025-71381?

Medium severity, with a CVSS score of 6.5, published 30 June 2026.

Which products and versions are affected?

hono (npm) < 4.10.3, SEMVER:introduced=0,fixed=4.10.3.

Is there a fix for CVE-2025-71381?

Yes. hono (npm): upgrade to 4.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-71381 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-71381?

Check whether you run hono (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-71381: Hono CORS middleware Vary header injection

Q: Which products and versions are affected?

hono (npm) < 4.10.3, SEMVER:introduced=0,fixed=4.10.3.

Q: Is there a fix for CVE-2025-71381?

Yes. hono (npm): upgrade to 4.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-71381 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-71381?

Check whether you run hono (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-71381 · Severity: medium · CVSS 6.5 · Published 2026-06-30

Hono, a popular web framework, contains a flaw in its Cross-Origin Resource Sharing (CORS) security component. An attacker can manipulate how the server communicates with web caches and proxies by injecting custom headers into the server's response. This can lead to cache pollution, where legitimate users receive incorrect or restricted content, potentially bypassing intended security restrictions.

Technologies: hono (npm). Vendors: npm.

Quick answers

Is CVE-2025-71381 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-71381 being exploited in the wild.
How severe is CVE-2025-71381?: Medium severity, with a CVSS score of 6.5, published 30 June 2026.
Which products and versions are affected?: hono (npm) < 4.10.3, SEMVER:introduced=0,fixed=4.10.3.
Is there a fix for CVE-2025-71381?: Yes. hono (npm): upgrade to 4.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-71381 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-71381?: Check whether you run hono (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

hono (npm): upgrade to 4.10.3 or later
```
npm install hono@4.10.3
```

Technical details

A vulnerability exists in the Hono CORS middleware when the 'origin' configuration is set to something other than '*'. The middleware incorrectly copies the 'Vary' header from the incoming HTTP request and reflects it into the HTTP response. Because 'Vary' is intended to be a server-managed response header that dictates cache key generation, this reflection allows an attacker to perform header injection. By providing arbitrary values, an attacker can cause cache key pollution or force inconsistent CORS enforcement in environments utilizing shared caches or intermediate proxies. The issue is classified as CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers) and is resolved in version 4.10.3.

Affected products

Hono Hono < 4.10.2

Identifiers

CVE-2025-71381
GHSA-q7jf-gf43-6x6p

Timeline

2025-10-24: advisory: GitHub Security Advisory published
2026-06-30: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.