← Vulnerability feed

Vulnerability record · CVE-2026-54290 · published 22 June 2026

CVE-2026-54290: Hono is a Web application framework that provides support for any JavaScript runtime.

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins. This vulnerability is fixed in 4.12.25.

7.1 CVSS 3.1 High EPSS 0.33% · top 76.6% CWE-942 · CWE-942 Deferred
7.1CVSS 3.1 base score
0.33%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
1References
22 Jun 2026Last modified by NVD

Description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins. This vulnerability is fixed in 4.12.25.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

References

LinkTags
https://github.com/honojs/hono/security/advisories/GHSA-88fw-hqm2-52qc

Track CVE-2026-54290 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Source: NIST National Vulnerability Database (record CVE-2026-54290), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.