CVE-2026-69207: Hono ReDoS in CORS middleware via Access-Control-Request-Headers

Executive brief

A vulnerability in the Hono web framework's CORS middleware can allow an attacker to crash or slow down a web service. By sending a specially crafted request with a long sequence of spaces in the headers, an attacker can force the server to consume excessive CPU power. This can lead to a denial-of-service, making the application unavailable to legitimate users.

Technical details

The Hono CORS middleware (`hono/cors`) uses a regular expression to parse the `Access-Control-Request-Headers` header during HTTP OPTIONS preflight requests. This regex exhibits quadratic backtracking (O(n²)) when processing long strings of whitespace without delimiters. An unauthenticated remote attacker can exploit this by sending a large header value, causing high CPU utilization and blocking the event loop in single-threaded runtimes. The vulnerability exists in the default configuration where `allowHeaders` is not explicitly defined. A fix is available in version 4.12.34.

Affected products

• Hono Hono < 4.12.34

Timeline

• 2026-08-03: disclosed
• 2026-08-03: patched: Fixed in version 4.12.34
• 2026-08-03: advisory

References

• https://api.github.com/users/sonicnew
• https://github.com/sonicnew
• https://api.github.com/users/sonicnew/gists%7B/gist_id%7D
• https://api.github.com/users/sonicnew/repos
• https://avatars.githubusercontent.com/u/173318515?v=4
• https://api.github.com/users/sonicnew/events%7B/privacy%7D