CVE-2026-54290

Katalog CVE

CVSS 7.1 · High EPSS 0,33%

Kerentanan Permissive Cross-domain Security Policy with Untrusted Domains. Skor CVSS 3.1 7.1 (High) menurut github.com.

Deskripsi (NVD)

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins. This vulnerability is fixed in 4.12.25.

Rincian

Terbit di NVD

22 Juni 2026

Terakhir diubah

22 Juni 2026

Status NVD

Deferred

CVSS 3.1

7.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/honojs/hono/security/advisories/GHSA-88fw-hqm2-52qc