Regular Expression Denial of Service Vulnerability in Hono Framework by Hono

CVE-2026-69207

What is CVE-2026-69207?

The Hono framework, a versatile web application framework for JavaScript runtimes, contains a vulnerability within its built-in CORS middleware (hono/cors) before version 4.12.34. When processing preflight OPTIONS requests, the middleware improperly handles the Access-Control-Request-Headers header due to a whitespace-tolerant regular expression. This flaw allows an attacker to craft a header with extensive whitespace, which leads to significant CPU consumption and can delay request processing. If the service operates on a single-threaded runtime, such delays can stall other concurrent requests, potentially rendering the service unresponsive. This issue primarily affects deployments utilizing the default configuration with unset or empty allowHeaders, whereas applications specifying a non-empty allowHeaders remain unaffected. A patch has been released in version 4.12.34.

References