CVE-2026-44457: Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

May 9, 2026 (updated May 14, 2026)

Cache Middleware does not skip caching for responses that declare per-user variance via Vary: Authorization or Vary: Cookie. As a result, a response cached for one authenticated user may be served to subsequent requests from different users.

References

github.com/advisories/GHSA-p77w-8qqv-26rm
github.com/honojs/hono/security/advisories/GHSA-p77w-8qqv-26rm
nvd.nist.gov/vuln/detail/CVE-2026-44457

Code Behaviors & Features

Detect and mitigate CVE-2026-44457 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →