The vulnerability is a Regular Expression Denial of Service (ReDoS) in the built‑in CORS middleware of the Hono web application framework. During a preflight OPTIONS request the middleware parses the attacker‑controlled Access‑Control‑Request‑Headers header with a whitespace‑tolerant regular expression. Because the regex backtracks, the running time grows quadratically with the size of the header value. Large requests consisting of many whitespace characters can consume seconds of CPU, stall request processing, and on single‑threaded runtimes even block concurrent requests, potentially rendering the application unresponsive. The flaw is a CWE‑1333 weakness.

All deployments of Hono version 4.12.33 and earlier are affected. The issue occurs whenever the cors() middleware is invoked with an unset or empty allowHeaders configuration. In contrast, applications that explicitly set a non‑empty allowHeaders list are not vulnerable. The problem is fixed in Hono release 4.12.34 and later.

The CVSS score of 5.3 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote: an attacker can provoke the vulnerability by issuing a crafted preflight OPTIONS request containing a very long Access‑Control‑Request‑Headers value. If the application is exposed to the Internet and executes without mitigation, repeated or large requests can consume CPU resources and cause denial of service. The vulnerability can be exploited without authentication and does not require privileged local access.