CVE-2026-69207: Hono CORS Middleware ReDoS Vulnerability

CVE-2026-69207 Overview

CVE-2026-69207 is a regular expression denial of service (ReDoS) vulnerability in Hono, a lightweight web application framework for JavaScript runtimes. The flaw resides in the built-in CORS middleware hono/cors in versions prior to 4.12.34. During preflight OPTIONS requests, the middleware parses the attacker-controlled Access-Control-Request-Headers header with a whitespace-tolerant regular expression that exhibits quadratic backtracking. A single request containing a long run of whitespace can consume seconds of CPU time and stall request processing. On runtimes that share one execution thread across requests, concurrent requests are also blocked.

Critical Impact
Unauthenticated remote attackers can render Hono services unresponsive by sending crafted CORS preflight requests when cors() is used with an unset or empty allowHeaders.

Affected Products

Hono web framework versions prior to 4.12.34
Applications using hono/cors middleware with default configuration
Applications using cors() with unset or empty allowHeaders option

Discovery Timeline

2026-08-07 - CVE-2026-69207 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-69207

Vulnerability Analysis

The vulnerability is classified under [CWE-1333] Inefficient Regular Expression Complexity. The Hono CORS middleware handles browser preflight requests by extracting the list of requested headers from the Access-Control-Request-Headers HTTP header. To tolerate whitespace around commas, the middleware splits the header value using the regular expression /\s*,\s*/. This pattern contains adjacent variable-width whitespace groups that trigger catastrophic backtracking when the input contains long whitespace sequences without commas.

The header value is bounded only by the runtime's maximum HTTP header size, which is typically 8KB or larger. Parsing time grows quadratically with header length, so an attacker can transform a small request into seconds of blocking CPU work. Repeated requests exhaust the event loop and render the service unresponsive.

Root Cause

The root cause is the regex /\s*,\s*/ applied to attacker-controlled input via String.prototype.split. The engine tries multiple partitions of consecutive whitespace between the two \s* groups whenever no comma is found, producing quadratic complexity. The vulnerable code path executes whenever cors() runs with an unset or empty allowHeaders, which is the default configuration.

Attack Vector

Exploitation requires no authentication or user interaction. The attacker sends an HTTP OPTIONS preflight request to any endpoint protected by the vulnerable middleware. The Access-Control-Request-Headers header is populated with a long whitespace payload. The attack is network-reachable and trivial to automate against exposed Hono services.

typescript

// Patch from src/middleware/cors/index.ts
if (!headers?.length) {
  const requestHeaders = c.req.header('Access-Control-Request-Headers')
  if (requestHeaders) {
-    headers = requestHeaders.split(/\s*,\s*/)
+    headers = requestHeaders.split(',').map((h) => h.trim())
  }
}
if (headers?.length) {
// Source: https://github.com/honojs/hono/commit/93fc250d8b4df58ea542cb945171de8013d5e6d5

The patch replaces the vulnerable regex with a linear-time split on , followed by a per-token trim(), eliminating the backtracking behavior while preserving whitespace tolerance.

Detection Methods for CVE-2026-69207

Indicators of Compromise

Sustained CPU utilization spikes correlated with inbound OPTIONS requests to Hono-backed endpoints
HTTP OPTIONS requests carrying unusually long Access-Control-Request-Headers values, especially with runs of whitespace and few or no commas
Elevated request latency or event-loop lag metrics on Node.js, Bun, Deno, or edge runtimes hosting Hono applications
Repeated preflight requests from the same source IP or user agent within short time windows

Detection Strategies

Inspect access logs and reverse proxy telemetry for OPTIONS requests with Access-Control-Request-Headers values exceeding a few hundred bytes.
Correlate CPU or event-loop stall alerts with concurrent preflight request volumes at the ingress tier.
Add WAF or CDN rules that flag preflight requests when the request header value contains long whitespace sequences.

Monitoring Recommendations

Instrument Hono applications with per-route latency histograms and alert on tail-latency regressions on OPTIONS handlers.
Track dependency versions of hono across services and alert on any deployments running below 4.12.34.
Forward web server and reverse proxy logs to a centralized analytics pipeline and hunt for high-entropy Access-Control-Request-Headers values.

How to Mitigate CVE-2026-69207

Immediate Actions Required

Upgrade Hono to version 4.12.34 or later across all services that use hono/cors.
Audit application code for calls to cors() and confirm whether allowHeaders is explicitly set to a non-empty list.
Deploy an ingress-level request size limit for HTTP headers to reduce the maximum quadratic cost.

Patch Information

The issue is fixed in Hono 4.12.34. The fix replaces the vulnerable regex split with requestHeaders.split(',').map((h) => h.trim()). Details are available in the GitHub Security Advisory GHSA-8j4g-w8fx-2239, the v4.12.34 release notes, and the remediation commit.

Workarounds

Configure cors() with an explicit non-empty allowHeaders array; this bypasses the vulnerable parsing path entirely.
Enforce a strict maximum HTTP header size at a reverse proxy or CDN in front of the Hono application.
Add a WAF rule that rejects OPTIONS requests whose Access-Control-Request-Headers value exceeds a defined byte threshold or contains long whitespace runs.

bash

# Example: set explicit allowHeaders to bypass the vulnerable code path
import { Hono } from 'hono'
import { cors } from 'hono/cors'

const app = new Hono()

app.use('*', cors({
  origin: 'https://example.com',
  allowHeaders: ['Content-Type', 'Authorization', 'X-Requested-With'],
  allowMethods: ['GET', 'POST', 'OPTIONS'],
}))