CVE-2025-71381

Executive Summary

CVE-2025-71381 is a medium-severity vulnerability in the Hono web framework (versions before 4.10.2, fixed in 4.10.3) affecting its CORS middleware. The flaw allows an attacker to inject arbitrary Vary header values into HTTP responses by supplying them in the incoming request's Vary header. This occurs because the middleware incorrectly copies the Vary header from the request into the response when the Access-Control-Allow-Origin is not set to *. This behavior can lead to cache key pollution in shared caching environments (e.g., CDNs, reverse proxies), potentially causing cache poisoning, denial of service, or inconsistent CORS enforcement. The vulnerability has a CVSS score of 6.5 (Medium) and currently has no known public exploit code or active exploitation in the wild (EPSS 0.0%).

Supply Chain & Package Security

Hono is a JavaScript/TypeScript web framework distributed via npm. This vulnerability affects all downstream applications and services that use the affected CORS middleware. Organizations using Hono in their supply chain should immediately audit their dependencies and update to version 4.10.3 or later. The package is widely used in serverless and edge computing environments, making this a critical supply chain concern for cloud-native applications.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: High (A:H)

Threat Level: Medium. While the vulnerability does not directly expose sensitive data, it can be exploited to poison caches, leading to denial of service or serving malicious content to users. The low attack complexity and lack of required privileges make it attractive for attackers targeting shared caching infrastructures.

Deep Dive & Mechanics

The vulnerability resides in Hono's CORS middleware, specifically in the logic that handles the Vary response header. When the Access-Control-Allow-Origin is not set to *, the middleware is designed to set the Vary: Origin header to inform caches that the response varies based on the Origin request header. However, due to a coding flaw, the middleware copies the entire Vary header from the incoming request into the response instead of only setting the appropriate value.

Root Cause: The middleware uses the set method on the response headers object, which overwrites any existing Vary header. However, it first reads the Vary header from the incoming request and then sets it on the response. This allows an attacker to inject arbitrary values into the Vary header.

Attack Scenario:

1. An attacker sends a request to a Hono-based application with a crafted Vary header, e.g., Vary: X-Injected-Header.
2. The CORS middleware copies this value into the response's Vary header.
3. A shared cache (e.g., CDN, reverse proxy) sees the Vary: X-Injected-Header and caches the response based on that header.
4. The attacker can then send requests with different X-Injected-Header values to poison the cache, causing other users to receive cached responses intended for different origins or with different content.

Impact: Cache key pollution can lead to:

• Serving stale or incorrect content to users.
• Bypassing CORS restrictions in cached responses.
• Denial of service by exhausting cache storage with many unique cache keys.

Vulnerable vs. Patched Code

Vulnerable Code (Hono < 4.10.2):

// In CORS middleware
if (origin !== '*') {
  res.headers.set('Vary', req.headers.get('Vary') || 'Origin');
}

Patched Code (Hono >= 4.10.3):

// In CORS middleware
if (origin !== '*') {
  res.headers.set('Vary', 'Origin');
}

The fix removes the dangerous behavior of copying the request's Vary header and instead hardcodes the value to Origin, which is the correct and intended behavior.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Hono application running version < 4.10.2 with CORS middleware enabled and Access-Control-Allow-Origin not set to *.
• A shared caching layer (e.g., Varnish, Cloudflare, or a reverse proxy like Nginx with caching enabled).

Exploitation Steps:

1. Identify a target endpoint that uses CORS middleware.
2. Send a request with a crafted Vary header:

   curl -H "Origin: https://attacker.com" -H "Vary: X-Injected-Header" http://target.com/api/data
   

3. Observe the response's Vary header:

   curl -I -H "Origin: https://attacker.com" -H "Vary: X-Injected-Header" http://target.com/api/data
   

   Expected response header: Vary: X-Injected-Header
4. To poison the cache, send multiple requests with different X-Injected-Header values:

   for i in {1..100}; do
     curl -H "Origin: https://attacker.com" -H "Vary: X-Injected-Header: $i" http://target.com/api/data
   done
   

5. The cache will now have many entries, potentially causing cache exhaustion or serving incorrect content to users.

Advanced Exploitation:

• Combine with other cache poisoning techniques (e.g., using X-Forwarded-Host or X-Original-URL) to further manipulate cache keys.
• Use the injected Vary header to bypass CORS restrictions by making the cache serve responses intended for different origins.

Blue Team

Detection:

• Monitor for unusual Vary header values in HTTP responses, especially those that are not Origin, Accept, Accept-Encoding, or User-Agent.
• Look for requests with a Vary header that is not empty or standard.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Immediately upgrade Hono to version 4.10.3 or later.
• If immediate upgrade is not possible, implement a reverse proxy or WAF rule to strip or validate the Vary header from incoming requests before they reach the Hono application.
• Configure shared caches to ignore or sanitize the Vary header from upstream responses.

Lab Setup:

1. Create a simple Hono application with vulnerable CORS middleware:

   import { Hono } from 'hono'
   import { cors } from 'hono/cors'
   
   const app = new Hono()
   
   app.use('/api/*', cors({
     origin: 'https://trusted-origin.com'
   }))
   
   app.get('/api/data', (c) => {
     return c.json({ message: 'Hello, World!' })
   })
   
   export default app
   

2. Deploy behind a caching proxy (e.g., Nginx with proxy_cache enabled).
3. Test the vulnerability using the Red Team steps above.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing a Vary header with non-standard values (e.g., Vary: X-Custom-Header).
  • HTTP responses with a Vary header that includes values other than Origin, Accept, Accept-Encoding, or User-Agent.
  • Unusual patterns of requests with varying Vary header values targeting the same endpoint.

• Log IOCs:

  • Web server logs showing Vary header values that are not standard.
  • Cache logs showing an unusually high number of cache misses or cache key variations.

• File IOCs:

  • No file-based IOCs are associated with this vulnerability.

Detection Engineering

YARA Rule

rule CVE_2025_71381_Hono_CORS_Vary_Injection {
  meta:
    description = "Detects HTTP responses with injected Vary header from Hono CORS middleware"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-71381"
    severity = "medium"
  strings:
    $vary_header = /Vary:\s*(?!Origin|Accept|Accept-Encoding|User-Agent)[^\r\n]+/i
  condition:
    $vary_header
}

Sigma Rule

title: Hono CORS Middleware Vary Header Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP responses with injected Vary header from Hono CORS middleware (CVE-2025-71381)
author: Valters IT
date: 2025-04-10
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-71381
logsource:
  category: webserver
  product: generic
detection:
  selection:
    response_headers|contains: 'Vary:'
  filter:
    response_headers|contains|all:
      - 'Vary: Origin'
      - 'Vary: Accept'
      - 'Vary: Accept-Encoding'
      - 'Vary: User-Agent'
  condition: selection and not filter
falsepositives:
  - Legitimate custom Vary headers set by application code
level: medium
tags:
  - attack.initial_access
  - attack.t1190

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-71381 Hono CORS Middleware Vary Header Injection"; flow:to_server; content:"Vary"; http_header; nocase; pcre:"/Vary:\s*(?!Origin|Accept|Accept-Encoding|User-Agent)[^\r\n]+/iH"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Hono: Update to version 4.10.3 or later. This is the only complete fix.

   npm install hono@4.10.3
   

2. Patch Workaround: If upgrade is not possible, implement a reverse proxy or WAF rule to strip the Vary header from incoming requests:
   • Nginx:

     location / {
       proxy_set_header Vary "";
       proxy_pass http://backend;
     }
     

   • Apache:

     RequestHeader unset Vary
     

3. Cache Configuration: Configure shared caches to ignore or sanitize the Vary header from upstream responses:
   • Varnish:

     sub vcl_backend_response {
       if (beresp.http.Vary ~ "^(?!Origin|Accept|Accept-Encoding|User-Agent)") {
         unset beresp.http.Vary;
       }
     }
     

Long-term Mitigations:

• Implement strict input validation for all HTTP headers at the edge.
• Use a Web Application Firewall (WAF) with rules to detect and block non-standard Vary header values.
• Regularly audit dependencies for known vulnerabilities using tools like npm audit or Snyk.
• Adopt a security-focused development lifecycle that includes threat modeling for middleware components.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert