Hono’s CORS middleware contains a flaw that copies the Vary header from the request into the response when the Origin is not set to '*'. Because Vary is a server‑controlled response header, an attacker can supply an arbitrary Vary value. This injection—identified as CWE‑113—can lead to cache key pollution and cause the server’s CORS enforcement to be inconsistent, potentially allowing or blocking cross‑origin requests incorrectly.

The flaw exists in all Hono releases prior to 4.10.3; it was addressed in version 4.10.3. Deployments of the Hono framework on Node.js that depend on CORS handling and rely on shared edge caches or reverse proxies are susceptible.

With a CVSS score of 6.9 and an EPSS score of < 1%, the vulnerability represents a moderate risk. Exploitation requires only a crafted HTTP request that includes an arbitrary Vary header and an Origin header not equal to '*'; no authentication is required. The affected environments are those using shared caches or reverse proxies, where a polluted cache might serve incorrect content and undermine the intended CORS policy.