Executive brief
Hono is a web framework used to build applications and APIs. A vulnerability in its caching component means that private, user-specific data (like account details or personal info) could be accidentally stored and then served to the wrong person. This could lead to unauthorized data exposure and privacy violations for users of applications built with Hono.
Technical details
The Cache Middleware in Hono does not treat 'Vary: Authorization' or 'Vary: Cookie' headers as reasons to skip or partition the cache. While it correctly handles 'Vary: *' and specific 'Cache-Control' directives like 'private' or 'no-store', it fails to recognize standard RFC 9110/9111 signals for per-user variance. An attacker or a random subsequent user could receive a cached response containing sensitive PII or session-specific data intended for a different authenticated user. This occurs when an endpoint relies on these Vary headers without explicitly setting 'Cache-Control: private'. The issue is resolved in version 4.12.18.
Affected products
- honojs hono < 4.12.18
Timeline
- 2026-05-09: advisory: GitHub Advisory published
- 2026-05-09: disclosed
- 2026-05-13: other: NVD published