CVE-2026-54290: hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard

June 16, 2026 (updated July 21, 2026)

With credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request’s Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins.

References

github.com/advisories/GHSA-88fw-hqm2-52qc
github.com/honojs/hono/security/advisories/GHSA-88fw-hqm2-52qc
nvd.nist.gov/vuln/detail/CVE-2026-54290

Code Behaviors & Features

Detect and mitigate CVE-2026-54290 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →