UpHeron
All vulnerabilities

npm

CVE-2026-44457

Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

Severity
Medium 5.3
Published
9 May 2026
Last changed
10 Sept 2026
Added to UpHeron
22 Oct 2026
Fixed in
4.12.18
Also known as
GHSA-p77w-8qqv-26rm
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
hononpm · osv:npm:hono
  • Every version before 4.12.18

References