Hono’s CORS middleware mistakenly copies a request’s Vary header into the response when the Origin is not set to '*', allowing an attacker to inject arbitrary Vary values that are reflected back. This Vary header injection is identified as CWE‑113 and can lead to cache key pollution and inconsistent enforcement of CORS rules, creating conditions where cross‑origin requests may be incorrectly allowed or blocked.

The flaw exists in all Hono releases prior to 4.10.2; it was addressed in version 4.10.3. Deployments of the Hono framework on Node.js that depend on CORS handling and rely on shared edge caches or reverse proxies are susceptible.

With a CVSS score of 6.9 and no EPSS data, the vulnerability represents a moderate risk. Exploitation requires only an HTTP request that includes a crafted Vary header and an Origin not equal to '*'; no authentication is needed. As the vulnerability impacts cache integrity and CORS behavior, attackers could manipulate cache entries or create misleading CORS responses, making remediation important even if a high‑likelihood exploit is not documented.