CVE-2026-69207

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in CORS middleware, hono/cors, is vulnerable to a regular expression denial of service (ReDoS). During a preflight OPTIONS request, the middleware parses the attacker-controlled Access-Control-Request-Headers header using a whitespace-tolerant regular expression whose backtracking makes its running time quadratic in the input length. Because the header value is bounded only by the deployment's maximum HTTP header size, a single preflight carrying a long run of whitespace can consume seconds of CPU and block request processing. On runtimes that share one execution thread across requests, this stalls concurrent requests as well, and repeated requests can render the service unresponsive. This affects the default configuration, since the vulnerable path is reached whenever cors() is used with an unset or empty allowHeaders. Applications that set a non-empty allowHeaders are not affected. This issue is fixed in version 4.12.34.

• CWE-1333

• https://github.com/honojs/hono/commit/93fc250d8b4df58ea542cb945171de8013d5e6d5
• https://github.com/honojs/hono/releases/tag/v4.12.34
• https://github.com/honojs/hono/security/advisories/GHSA-8j4g-w8fx-2239

Published

Aug 7, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-69201Http4s is a Scala interface for HTTP services. Prior to 0.23…5.9
• CVE-2026-69202Http4s is a Scala interface for HTTP services. Prior to 0.23…7.5
• CVE-2026-69203Http4s is a Scala interface for HTTP services. Prior to 0.23…7.5
• CVE-2026-69204Http4s is a Scala interface for HTTP services. Prior to 0.23…9.2
• CVE-2026-69205Http4s is a Scala interface for HTTP services. Prior to 0.23…8.7
• CVE-2026-69206Http4s is a Scala interface for HTTP services. Prior to 0.23…5.9
• CVE-2026-69208Http4s is a Scala interface for HTTP services. Prior to 0.23…7.5
• CVE-2026-69209Http4s is a Scala interface for HTTP services. Prior to 0.23…7.5
• CVE-2026-6921Race in GPU in Google Chrome on Windows prior to 147.0.7727.…8.3
• CVE-2026-69210Http4s is a Scala interface for HTTP services. Prior to 0.23…7.5
• CVE-2026-69211Http4s is a Scala interface for HTTP services. Prior to 0.23…4.8
• CVE-2026-69212Http4s is a Scala interface for HTTP services. Prior to 0.23…5.9