CVE-2026-44457

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Vary: Authorization or Vary: Cookie. As a result, a response cached for one authenticated user may be served to subsequent requests from different users. This vulnerability is fixed in 4.12.18.

• CWE-524

• https://github.com/honojs/hono/security/advisories/GHSA-p77w-8qqv-26rmVendor Advisory

Published

May 13, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44451Lumiverse is a full-featured AI chat application. Prior to 0…9.3
• CVE-2026-44452h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and …5.9
• CVE-2026-44453h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and …7.5
• CVE-2026-44454Coder allows organizations to provision remote development e…8.8
• CVE-2026-44455Hono is a Web application framework that provides support fo…6.1
• CVE-2026-44456Hono is a Web application framework that provides support fo…6.5
• CVE-2026-44458Hono is a Web application framework that provides support fo…4.3
• CVE-2026-44459Hono is a Web application framework that provides support fo…3.8
• CVE-2026-4446Use after free in WebRTC in Google Chrome prior to 146.0.768…8.8
• CVE-2026-44460FileRise is a self-hosted web-based file manager with multi-…7.4
• CVE-2026-44461Zed is a code editor. Prior to 0.227.1, Zed builds SSH/WSL r…8.6
• CVE-2026-44462Zed is a code editor. Prior to 0.229.0, Zed's terminal tool …8.8