CVE-2026-54290: Hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard
Summary
With credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins.
Details
The spec forbids Access-Control-Allow-Origin: with credentials and browsers reject it, so this configuration used to fail closed. In affected versions the middleware reflects the request Origin instead, so it now succeeds for every origin, including null. The preflight also echoes the requested headers back, approving non-simple credentialed requests too.
This issue arises when an application enables credentials: true and leaves origin unset or set to the wildcard.
Impact
Any third-party page a logged-in user visits can read the application's cookie-authenticated endpoints and perform credentialed state-changing requests. This affects applications that enable credentialed CORS without restricting origin.
Other sources
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins. This vulnerability is fixed in 4.12.25.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/honoto a version that resolves this vulnerability.Fixed in 4.12.25 - Upgrade
Upgrade
Honoto a version that resolves this vulnerability.Fixed in 4.12.25
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54290?
The severity of CVE-2026-54290 is rated as high with a score of 7.1.
How do I fix CVE-2026-54290?
To fix CVE-2026-54290, ensure that the CORS Middleware does not use the default wildcard and explicitly set the `origin` to a trusted domain.
What are the potential risks associated with CVE-2026-54290?
CVE-2026-54290 allows malicious sites to make credentialed cross-origin requests, potentially exposing sensitive cookie information.
Who is affected by CVE-2026-54290?
CVE-2026-54290 affects users of the npm package Hono when configured with `credentials: true` and no specific `origin` defined.
When was CVE-2026-54290 published?
CVE-2026-54290 was published on June 16, 2026.