Описание
Hono before 4.10.2 (fixed in 4.10.3) contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response. Because Vary is a response header that should be managed by the server, an attacker can supply arbitrary Vary values that are reflected into the response, potentially causing cache key pollution and inconsistent CORS enforcement in environments that rely on shared caches or proxies.
A flaw was found in Hono's Cross-Origin Resource Sharing (CORS) middleware. When the origin is not set to a wildcard, the middleware improperly copies the Vary header from incoming requests into the response. This allows an attacker to inject arbitrary Vary values, potentially leading to cache key pollution and inconsistent CORS enforcement. Such an issue can affect environments that rely on shared caches or proxies, potentially enabling a bypass of CORS policies.
Отчет
Red Hat products that include the Hono npm package already ship version 4.11.4 or later, which contains the fix for this vulnerability. No Red Hat products are affected.
Меры по смягчению последствий
No mitigation is needed. All Red Hat products shipping the Hono npm package already include a version that contains the fix for this issue.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Migration Toolkit for Applications 8 | mta/mta-solution-server-rhel9 | Not affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-27/mcp-server-rhel9 | Not affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-tech-preview/mcp-server-rhel9 | Not affected | ||
| Red Hat Developer Hub | rhdh/rhdh-hub-rhel9 | Not affected | ||
| Red Hat Hardened Images | grafana12.4 | Not affected | ||
| Red Hat Hardened Images | grafana13.1 | Not affected | ||
| Red Hat OpenShift Dev Spaces | devspaces/code-rhel9 | Not affected |
Показывать по
Дополнительная информация
Статус:
6.5 Medium
CVSS3
Связанные уязвимости
Hono before 4.10.2 (fixed in 4.10.3) contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response. Because Vary is a response header that should be managed by the server, an attacker can supply arbitrary Vary values that are reflected into the response, potentially causing cache key pollution and inconsistent CORS enforcement in environments that rely on shared caches or proxies.
Hono before 4.10.2 (fixed in 4.10.3) contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response. Because Vary is a response header that should be managed by the server, an attacker can supply arbitrary Vary values that are reflected into the response, potentially causing cache key pollution and inconsistent CORS enforcement in environments that rely on shared caches or proxies.
6.5 Medium
CVSS3