{"schema_version":"2","view":"grouped","data":[{"id":74275,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-5mjp-pc48-cq3f","summary":"CGA-5mjp-pc48-cq3f","evidence":"osv:CGA-5mjp-pc48-cq3f","products":[{"name":{"value":"hono-service-command-router","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-5mjp-pc48-cq3f","aliases":["CGA-5mjp-pc48-cq3f"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-command-router","purl":"pkg:apk/chainguard/hono-service-command-router?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5mjp-pc48-cq3f.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-command-router","component_purl":"pkg:apk/hono-service-command-router@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-22T01:37:29Z"}]}}],"modified":"2026-10-03T16:13:05.117140861Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:fee6e993-016f-4634-a570-4c7e0d236b31","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5mjp-pc48-cq3f","advisory_id":"fee6e993-016f-4634-a570-4c7e0d236b31","event_types":["advisory"],"published_at":"2026-10-26T09:21:57.777043+00:00","technologies":["core-osv","hono-service-command-router"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:46:21+00:00","detail_url":"/advisories/advisory%3Afee6e993-016f-4634-a570-4c7e0d236b31","group":{"id":"advisory:fee6e993-016f-4634-a570-4c7e0d236b31","revision":1,"primary_event_id":78773,"change":"published","superseded_by":[],"changed":{"id":78773,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-5mjp-pc48-cq3f","summary":"CGA-5mjp-pc48-cq3f","evidence":"osv:CGA-5mjp-pc48-cq3f","products":[{"name":{"value":"hono-service-command-router","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-5mjp-pc48-cq3f","aliases":["CGA-5mjp-pc48-cq3f"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-command-router","purl":"pkg:apk/chainguard/hono-service-command-router?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5mjp-pc48-cq3f.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-command-router","component_purl":"pkg:apk/hono-service-command-router@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-22T01:37:29Z"}]}}],"modified":"2026-10-03T16:13:05.117140861Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:fee6e993-016f-4634-a570-4c7e0d236b31","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5mjp-pc48-cq3f","advisory_id":"fee6e993-016f-4634-a570-4c7e0d236b31","event_types":["advisory"],"published_at":"2026-10-26T09:21:57.777043+00:00","technologies":["core-osv","hono-service-command-router"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:46:21+00:00","detail_url":"/events/78773"},"members":[{"id":78773,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-5mjp-pc48-cq3f","summary":"CGA-5mjp-pc48-cq3f","evidence":"osv:CGA-5mjp-pc48-cq3f","products":[{"name":{"value":"hono-service-command-router","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-5mjp-pc48-cq3f","aliases":["CGA-5mjp-pc48-cq3f"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-command-router","purl":"pkg:apk/chainguard/hono-service-command-router?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5mjp-pc48-cq3f.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-command-router","component_purl":"pkg:apk/hono-service-command-router@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-22T01:37:29Z"}]}}],"modified":"2026-10-03T16:13:05.117140861Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:fee6e993-016f-4634-a570-4c7e0d236b31","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5mjp-pc48-cq3f","advisory_id":"fee6e993-016f-4634-a570-4c7e0d236b31","event_types":["advisory"],"published_at":"2026-10-26T09:21:57.777043+00:00","technologies":["core-osv","hono-service-command-router"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:46:21+00:00","detail_url":"/events/78773"}]}},{"id":74259,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-g9w6-62vg-qcq5","summary":"CGA-g9w6-62vg-qcq5","evidence":"osv:CGA-g9w6-62vg-qcq5","products":[{"name":{"value":"hono-service-auth","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-g9w6-62vg-qcq5","aliases":["CGA-g9w6-62vg-qcq5"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-auth","purl":"pkg:apk/chainguard/hono-service-auth?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g9w6-62vg-qcq5.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-auth","component_purl":"pkg:apk/hono-service-auth@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T14:02:43Z"}]}}],"modified":"2026-10-03T16:13:04.426288396Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:49d6a2cd-acfb-4794-a2fd-c7e51d285de7","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g9w6-62vg-qcq5","advisory_id":"49d6a2cd-acfb-4794-a2fd-c7e51d285de7","event_types":["advisory"],"published_at":"2026-10-26T08:59:16.359559+00:00","technologies":["core-osv","hono-service-auth"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:49:40+00:00","detail_url":"/advisories/advisory%3A49d6a2cd-acfb-4794-a2fd-c7e51d285de7","group":{"id":"advisory:49d6a2cd-acfb-4794-a2fd-c7e51d285de7","revision":1,"primary_event_id":78629,"change":"published","superseded_by":[],"changed":{"id":78629,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-g9w6-62vg-qcq5","summary":"CGA-g9w6-62vg-qcq5","evidence":"osv:CGA-g9w6-62vg-qcq5","products":[{"name":{"value":"hono-service-auth","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-g9w6-62vg-qcq5","aliases":["CGA-g9w6-62vg-qcq5"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-auth","purl":"pkg:apk/chainguard/hono-service-auth?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g9w6-62vg-qcq5.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-auth","component_purl":"pkg:apk/hono-service-auth@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T14:02:43Z"}]}}],"modified":"2026-10-03T16:13:04.426288396Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:49d6a2cd-acfb-4794-a2fd-c7e51d285de7","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g9w6-62vg-qcq5","advisory_id":"49d6a2cd-acfb-4794-a2fd-c7e51d285de7","event_types":["advisory"],"published_at":"2026-10-26T08:59:16.359559+00:00","technologies":["core-osv","hono-service-auth"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:49:40+00:00","detail_url":"/events/78629"},"members":[{"id":78629,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-g9w6-62vg-qcq5","summary":"CGA-g9w6-62vg-qcq5","evidence":"osv:CGA-g9w6-62vg-qcq5","products":[{"name":{"value":"hono-service-auth","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-g9w6-62vg-qcq5","aliases":["CGA-g9w6-62vg-qcq5"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-auth","purl":"pkg:apk/chainguard/hono-service-auth?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g9w6-62vg-qcq5.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-auth","component_purl":"pkg:apk/hono-service-auth@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T14:02:43Z"}]}}],"modified":"2026-10-03T16:13:04.426288396Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:49d6a2cd-acfb-4794-a2fd-c7e51d285de7","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g9w6-62vg-qcq5","advisory_id":"49d6a2cd-acfb-4794-a2fd-c7e51d285de7","event_types":["advisory"],"published_at":"2026-10-26T08:59:16.359559+00:00","technologies":["core-osv","hono-service-auth"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:49:40+00:00","detail_url":"/events/78629"}]}},{"id":74208,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-g8q3-7v82-hqhm","summary":"CGA-g8q3-7v82-hqhm","evidence":"osv:CGA-g8q3-7v82-hqhm","products":[{"name":{"value":"hono-adapter-mqtt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-g8q3-7v82-hqhm","aliases":["CGA-g8q3-7v82-hqhm"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-adapter-mqtt","purl":"pkg:apk/chainguard/hono-adapter-mqtt?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g8q3-7v82-hqhm.json"},"ecosystem_specific":{"components":[{"component_name":"hono-adapter-mqtt","component_purl":"pkg:apk/hono-adapter-mqtt@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T14:17:40Z"}]}}],"modified":"2026-10-03T16:13:00.172790130Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:47793519-47ef-4ce6-85f2-1fd0b8516ff6","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g8q3-7v82-hqhm","advisory_id":"47793519-47ef-4ce6-85f2-1fd0b8516ff6","event_types":["advisory"],"published_at":"2026-10-26T07:16:57.042223+00:00","technologies":["core-osv","hono-adapter-mqtt"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:10:46+00:00","detail_url":"/advisories/advisory%3A47793519-47ef-4ce6-85f2-1fd0b8516ff6","group":{"id":"advisory:47793519-47ef-4ce6-85f2-1fd0b8516ff6","revision":1,"primary_event_id":77752,"change":"published","superseded_by":[],"changed":{"id":77752,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-g8q3-7v82-hqhm","summary":"CGA-g8q3-7v82-hqhm","evidence":"osv:CGA-g8q3-7v82-hqhm","products":[{"name":{"value":"hono-adapter-mqtt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-g8q3-7v82-hqhm","aliases":["CGA-g8q3-7v82-hqhm"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-adapter-mqtt","purl":"pkg:apk/chainguard/hono-adapter-mqtt?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g8q3-7v82-hqhm.json"},"ecosystem_specific":{"components":[{"component_name":"hono-adapter-mqtt","component_purl":"pkg:apk/hono-adapter-mqtt@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T14:17:40Z"}]}}],"modified":"2026-10-03T16:13:00.172790130Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:47793519-47ef-4ce6-85f2-1fd0b8516ff6","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g8q3-7v82-hqhm","advisory_id":"47793519-47ef-4ce6-85f2-1fd0b8516ff6","event_types":["advisory"],"published_at":"2026-10-26T07:16:57.042223+00:00","technologies":["core-osv","hono-adapter-mqtt"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:10:46+00:00","detail_url":"/events/77752"},"members":[{"id":77752,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-g8q3-7v82-hqhm","summary":"CGA-g8q3-7v82-hqhm","evidence":"osv:CGA-g8q3-7v82-hqhm","products":[{"name":{"value":"hono-adapter-mqtt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-g8q3-7v82-hqhm","aliases":["CGA-g8q3-7v82-hqhm"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-adapter-mqtt","purl":"pkg:apk/chainguard/hono-adapter-mqtt?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g8q3-7v82-hqhm.json"},"ecosystem_specific":{"components":[{"component_name":"hono-adapter-mqtt","component_purl":"pkg:apk/hono-adapter-mqtt@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T14:17:40Z"}]}}],"modified":"2026-10-03T16:13:00.172790130Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:47793519-47ef-4ce6-85f2-1fd0b8516ff6","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g8q3-7v82-hqhm","advisory_id":"47793519-47ef-4ce6-85f2-1fd0b8516ff6","event_types":["advisory"],"published_at":"2026-10-26T07:16:57.042223+00:00","technologies":["core-osv","hono-adapter-mqtt"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:10:46+00:00","detail_url":"/events/77752"}]}},{"id":74199,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-f96m-h997-gxxx","summary":"CGA-f96m-h997-gxxx","evidence":"osv:CGA-f96m-h997-gxxx","products":[{"name":{"value":"hono-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-f96m-h997-gxxx","aliases":["CGA-f96m-h997-gxxx"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-compat","purl":"pkg:apk/chainguard/hono-compat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f96m-h997-gxxx.json"},"ecosystem_specific":{"components":[{"component_name":"hono-compat","component_purl":"pkg:apk/hono-compat@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-22T00:29:27Z"}]}}],"modified":"2026-10-03T16:12:59.625280886Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a6b55cb2-4f30-4cc4-8013-f431c0d8b53e","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f96m-h997-gxxx","advisory_id":"a6b55cb2-4f30-4cc4-8013-f431c0d8b53e","event_types":["advisory"],"published_at":"2026-10-26T07:09:57.222651+00:00","technologies":["core-osv","hono-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:59:41+00:00","detail_url":"/advisories/advisory%3Aa6b55cb2-4f30-4cc4-8013-f431c0d8b53e","group":{"id":"advisory:a6b55cb2-4f30-4cc4-8013-f431c0d8b53e","revision":1,"primary_event_id":77683,"change":"published","superseded_by":[],"changed":{"id":77683,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-f96m-h997-gxxx","summary":"CGA-f96m-h997-gxxx","evidence":"osv:CGA-f96m-h997-gxxx","products":[{"name":{"value":"hono-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-f96m-h997-gxxx","aliases":["CGA-f96m-h997-gxxx"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-compat","purl":"pkg:apk/chainguard/hono-compat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f96m-h997-gxxx.json"},"ecosystem_specific":{"components":[{"component_name":"hono-compat","component_purl":"pkg:apk/hono-compat@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-22T00:29:27Z"}]}}],"modified":"2026-10-03T16:12:59.625280886Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a6b55cb2-4f30-4cc4-8013-f431c0d8b53e","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f96m-h997-gxxx","advisory_id":"a6b55cb2-4f30-4cc4-8013-f431c0d8b53e","event_types":["advisory"],"published_at":"2026-10-26T07:09:57.222651+00:00","technologies":["core-osv","hono-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:59:41+00:00","detail_url":"/events/77683"},"members":[{"id":77683,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-f96m-h997-gxxx","summary":"CGA-f96m-h997-gxxx","evidence":"osv:CGA-f96m-h997-gxxx","products":[{"name":{"value":"hono-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-f96m-h997-gxxx","aliases":["CGA-f96m-h997-gxxx"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-compat","purl":"pkg:apk/chainguard/hono-compat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f96m-h997-gxxx.json"},"ecosystem_specific":{"components":[{"component_name":"hono-compat","component_purl":"pkg:apk/hono-compat@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-22T00:29:27Z"}]}}],"modified":"2026-10-03T16:12:59.625280886Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a6b55cb2-4f30-4cc4-8013-f431c0d8b53e","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f96m-h997-gxxx","advisory_id":"a6b55cb2-4f30-4cc4-8013-f431c0d8b53e","event_types":["advisory"],"published_at":"2026-10-26T07:09:57.222651+00:00","technologies":["core-osv","hono-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:59:41+00:00","detail_url":"/events/77683"}]}},{"id":74169,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-xv93-5489-xc94","summary":"CGA-xv93-5489-xc94","evidence":"osv:CGA-xv93-5489-xc94","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xv93-5489-xc94","aliases":["CGA-xv93-5489-xc94"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xv93-5489-xc94.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-22T01:22:24Z"}]}}],"modified":"2026-10-03T16:12:57.846325082Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:794eb6aa-dc34-4425-9a6c-1c72750883b2","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xv93-5489-xc94","advisory_id":"794eb6aa-dc34-4425-9a6c-1c72750883b2","event_types":["advisory"],"published_at":"2026-10-26T06:34:03.121718+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:51:40+00:00","detail_url":"/advisories/advisory%3A794eb6aa-dc34-4425-9a6c-1c72750883b2","group":{"id":"advisory:794eb6aa-dc34-4425-9a6c-1c72750883b2","revision":1,"primary_event_id":77313,"change":"published","superseded_by":[],"changed":{"id":77313,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-xv93-5489-xc94","summary":"CGA-xv93-5489-xc94","evidence":"osv:CGA-xv93-5489-xc94","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xv93-5489-xc94","aliases":["CGA-xv93-5489-xc94"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xv93-5489-xc94.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-22T01:22:24Z"}]}}],"modified":"2026-10-03T16:12:57.846325082Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:794eb6aa-dc34-4425-9a6c-1c72750883b2","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xv93-5489-xc94","advisory_id":"794eb6aa-dc34-4425-9a6c-1c72750883b2","event_types":["advisory"],"published_at":"2026-10-26T06:34:03.121718+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:51:40+00:00","detail_url":"/events/77313"},"members":[{"id":77313,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-xv93-5489-xc94","summary":"CGA-xv93-5489-xc94","evidence":"osv:CGA-xv93-5489-xc94","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xv93-5489-xc94","aliases":["CGA-xv93-5489-xc94"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xv93-5489-xc94.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-22T01:22:24Z"}]}}],"modified":"2026-10-03T16:12:57.846325082Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:794eb6aa-dc34-4425-9a6c-1c72750883b2","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xv93-5489-xc94","advisory_id":"794eb6aa-dc34-4425-9a6c-1c72750883b2","event_types":["advisory"],"published_at":"2026-10-26T06:34:03.121718+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:51:40+00:00","detail_url":"/events/77313"}]}},{"id":73975,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-gcc6-gc89-2vv8","summary":"CGA-gcc6-gc89-2vv8","evidence":"osv:CGA-gcc6-gc89-2vv8","products":[{"name":{"value":"hono-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-gcc6-gc89-2vv8","aliases":["CGA-gcc6-gc89-2vv8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-compat","purl":"pkg:apk/chainguard/hono-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gcc6-gc89-2vv8.json"},"ecosystem_specific":{"components":[{"component_name":"hono-compat","component_purl":"pkg:apk/hono-compat@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T14:57:48Z"}]}}],"modified":"2026-10-03T16:12:50.181214204Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:56984461-dc4a-48ac-9c86-486d9add72ef","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gcc6-gc89-2vv8","advisory_id":"56984461-dc4a-48ac-9c86-486d9add72ef","event_types":["advisory"],"published_at":"2026-10-26T05:07:03.706543+00:00","technologies":["core-osv","hono-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T14:16:57+00:00","detail_url":"/advisories/advisory%3A56984461-dc4a-48ac-9c86-486d9add72ef","group":{"id":"advisory:56984461-dc4a-48ac-9c86-486d9add72ef","revision":1,"primary_event_id":76437,"change":"published","superseded_by":[],"changed":{"id":76437,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-gcc6-gc89-2vv8","summary":"CGA-gcc6-gc89-2vv8","evidence":"osv:CGA-gcc6-gc89-2vv8","products":[{"name":{"value":"hono-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-gcc6-gc89-2vv8","aliases":["CGA-gcc6-gc89-2vv8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-compat","purl":"pkg:apk/chainguard/hono-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gcc6-gc89-2vv8.json"},"ecosystem_specific":{"components":[{"component_name":"hono-compat","component_purl":"pkg:apk/hono-compat@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T14:57:48Z"}]}}],"modified":"2026-10-03T16:12:50.181214204Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:56984461-dc4a-48ac-9c86-486d9add72ef","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gcc6-gc89-2vv8","advisory_id":"56984461-dc4a-48ac-9c86-486d9add72ef","event_types":["advisory"],"published_at":"2026-10-26T05:07:03.706543+00:00","technologies":["core-osv","hono-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T14:16:57+00:00","detail_url":"/events/76437"},"members":[{"id":76437,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-gcc6-gc89-2vv8","summary":"CGA-gcc6-gc89-2vv8","evidence":"osv:CGA-gcc6-gc89-2vv8","products":[{"name":{"value":"hono-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-gcc6-gc89-2vv8","aliases":["CGA-gcc6-gc89-2vv8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-compat","purl":"pkg:apk/chainguard/hono-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gcc6-gc89-2vv8.json"},"ecosystem_specific":{"components":[{"component_name":"hono-compat","component_purl":"pkg:apk/hono-compat@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T14:57:48Z"}]}}],"modified":"2026-10-03T16:12:50.181214204Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:56984461-dc4a-48ac-9c86-486d9add72ef","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gcc6-gc89-2vv8","advisory_id":"56984461-dc4a-48ac-9c86-486d9add72ef","event_types":["advisory"],"published_at":"2026-10-26T05:07:03.706543+00:00","technologies":["core-osv","hono-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T14:16:57+00:00","detail_url":"/events/76437"}]}},{"id":73836,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-vw4r-qjqx-4vp3","summary":"CGA-vw4r-qjqx-4vp3","evidence":"osv:CGA-vw4r-qjqx-4vp3","products":[{"name":{"value":"hono-service-auth","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vw4r-qjqx-4vp3","aliases":["CGA-vw4r-qjqx-4vp3"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-auth","purl":"pkg:apk/chainguard/hono-service-auth?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vw4r-qjqx-4vp3.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-auth","component_purl":"pkg:apk/hono-service-auth@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T13:49:33Z"}]}}],"modified":"2026-10-03T16:12:47.154259267Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:28b6dbca-9c17-4c72-962d-e29cea2d1fd0","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vw4r-qjqx-4vp3","advisory_id":"28b6dbca-9c17-4c72-962d-e29cea2d1fd0","event_types":["advisory"],"published_at":"2026-10-26T04:51:00.247097+00:00","technologies":["core-osv","hono-service-auth"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:10:25+00:00","detail_url":"/advisories/advisory%3A28b6dbca-9c17-4c72-962d-e29cea2d1fd0","group":{"id":"advisory:28b6dbca-9c17-4c72-962d-e29cea2d1fd0","revision":1,"primary_event_id":76267,"change":"published","superseded_by":[],"changed":{"id":76267,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-vw4r-qjqx-4vp3","summary":"CGA-vw4r-qjqx-4vp3","evidence":"osv:CGA-vw4r-qjqx-4vp3","products":[{"name":{"value":"hono-service-auth","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vw4r-qjqx-4vp3","aliases":["CGA-vw4r-qjqx-4vp3"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-auth","purl":"pkg:apk/chainguard/hono-service-auth?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vw4r-qjqx-4vp3.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-auth","component_purl":"pkg:apk/hono-service-auth@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T13:49:33Z"}]}}],"modified":"2026-10-03T16:12:47.154259267Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:28b6dbca-9c17-4c72-962d-e29cea2d1fd0","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vw4r-qjqx-4vp3","advisory_id":"28b6dbca-9c17-4c72-962d-e29cea2d1fd0","event_types":["advisory"],"published_at":"2026-10-26T04:51:00.247097+00:00","technologies":["core-osv","hono-service-auth"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:10:25+00:00","detail_url":"/events/76267"},"members":[{"id":76267,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-vw4r-qjqx-4vp3","summary":"CGA-vw4r-qjqx-4vp3","evidence":"osv:CGA-vw4r-qjqx-4vp3","products":[{"name":{"value":"hono-service-auth","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vw4r-qjqx-4vp3","aliases":["CGA-vw4r-qjqx-4vp3"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-auth","purl":"pkg:apk/chainguard/hono-service-auth?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vw4r-qjqx-4vp3.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-auth","component_purl":"pkg:apk/hono-service-auth@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T13:49:33Z"}]}}],"modified":"2026-10-03T16:12:47.154259267Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:28b6dbca-9c17-4c72-962d-e29cea2d1fd0","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vw4r-qjqx-4vp3","advisory_id":"28b6dbca-9c17-4c72-962d-e29cea2d1fd0","event_types":["advisory"],"published_at":"2026-10-26T04:51:00.247097+00:00","technologies":["core-osv","hono-service-auth"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:10:25+00:00","detail_url":"/events/76267"}]}},{"id":73723,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-xqhm-qhmh-p933","summary":"CGA-xqhm-qhmh-p933","evidence":"osv:CGA-xqhm-qhmh-p933","products":[{"name":{"value":"hono-cli","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xqhm-qhmh-p933","aliases":["CGA-xqhm-qhmh-p933"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-cli","purl":"pkg:apk/chainguard/hono-cli?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xqhm-qhmh-p933.json"},"ecosystem_specific":{"components":[{"component_name":"hono-cli","component_purl":"pkg:apk/hono-cli@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T14:36:16Z"}]}}],"modified":"2026-10-03T16:12:44.890201230Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:80bac08e-f46e-4026-bba9-8cd341b027c3","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xqhm-qhmh-p933","advisory_id":"80bac08e-f46e-4026-bba9-8cd341b027c3","event_types":["advisory"],"published_at":"2026-10-26T04:42:44.300861+00:00","technologies":["core-osv","hono-cli"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:11:02+00:00","detail_url":"/advisories/advisory%3A80bac08e-f46e-4026-bba9-8cd341b027c3","group":{"id":"advisory:80bac08e-f46e-4026-bba9-8cd341b027c3","revision":1,"primary_event_id":76136,"change":"published","superseded_by":[],"changed":{"id":76136,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-xqhm-qhmh-p933","summary":"CGA-xqhm-qhmh-p933","evidence":"osv:CGA-xqhm-qhmh-p933","products":[{"name":{"value":"hono-cli","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xqhm-qhmh-p933","aliases":["CGA-xqhm-qhmh-p933"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-cli","purl":"pkg:apk/chainguard/hono-cli?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xqhm-qhmh-p933.json"},"ecosystem_specific":{"components":[{"component_name":"hono-cli","component_purl":"pkg:apk/hono-cli@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T14:36:16Z"}]}}],"modified":"2026-10-03T16:12:44.890201230Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:80bac08e-f46e-4026-bba9-8cd341b027c3","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xqhm-qhmh-p933","advisory_id":"80bac08e-f46e-4026-bba9-8cd341b027c3","event_types":["advisory"],"published_at":"2026-10-26T04:42:44.300861+00:00","technologies":["core-osv","hono-cli"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:11:02+00:00","detail_url":"/events/76136"},"members":[{"id":76136,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-xqhm-qhmh-p933","summary":"CGA-xqhm-qhmh-p933","evidence":"osv:CGA-xqhm-qhmh-p933","products":[{"name":{"value":"hono-cli","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xqhm-qhmh-p933","aliases":["CGA-xqhm-qhmh-p933"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-cli","purl":"pkg:apk/chainguard/hono-cli?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xqhm-qhmh-p933.json"},"ecosystem_specific":{"components":[{"component_name":"hono-cli","component_purl":"pkg:apk/hono-cli@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T14:36:16Z"}]}}],"modified":"2026-10-03T16:12:44.890201230Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:80bac08e-f46e-4026-bba9-8cd341b027c3","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xqhm-qhmh-p933","advisory_id":"80bac08e-f46e-4026-bba9-8cd341b027c3","event_types":["advisory"],"published_at":"2026-10-26T04:42:44.300861+00:00","technologies":["core-osv","hono-cli"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:11:02+00:00","detail_url":"/events/76136"}]}},{"id":73660,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-vw22-3c5m-vmh7","summary":"CGA-vw22-3c5m-vmh7","evidence":"osv:CGA-vw22-3c5m-vmh7","products":[{"name":{"value":"hono-service-device-registry-jdbc","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vw22-3c5m-vmh7","aliases":["CGA-vw22-3c5m-vmh7"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-device-registry-jdbc","purl":"pkg:apk/chainguard/hono-service-device-registry-jdbc?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vw22-3c5m-vmh7.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-device-registry-jdbc","component_purl":"pkg:apk/hono-service-device-registry-jdbc@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T13:26:26Z"}]}}],"modified":"2026-10-03T16:12:43.574168112Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0d001921-5a46-4535-9663-e66cc36c418c","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vw22-3c5m-vmh7","advisory_id":"0d001921-5a46-4535-9663-e66cc36c418c","event_types":["advisory"],"published_at":"2026-10-26T04:40:07.598464+00:00","technologies":["core-osv","hono-service-device-registry-jdbc"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:24:00+00:00","detail_url":"/advisories/advisory%3A0d001921-5a46-4535-9663-e66cc36c418c","group":{"id":"advisory:0d001921-5a46-4535-9663-e66cc36c418c","revision":1,"primary_event_id":76070,"change":"published","superseded_by":[],"changed":{"id":76070,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-vw22-3c5m-vmh7","summary":"CGA-vw22-3c5m-vmh7","evidence":"osv:CGA-vw22-3c5m-vmh7","products":[{"name":{"value":"hono-service-device-registry-jdbc","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vw22-3c5m-vmh7","aliases":["CGA-vw22-3c5m-vmh7"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-device-registry-jdbc","purl":"pkg:apk/chainguard/hono-service-device-registry-jdbc?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vw22-3c5m-vmh7.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-device-registry-jdbc","component_purl":"pkg:apk/hono-service-device-registry-jdbc@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T13:26:26Z"}]}}],"modified":"2026-10-03T16:12:43.574168112Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0d001921-5a46-4535-9663-e66cc36c418c","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vw22-3c5m-vmh7","advisory_id":"0d001921-5a46-4535-9663-e66cc36c418c","event_types":["advisory"],"published_at":"2026-10-26T04:40:07.598464+00:00","technologies":["core-osv","hono-service-device-registry-jdbc"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:24:00+00:00","detail_url":"/events/76070"},"members":[{"id":76070,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-vw22-3c5m-vmh7","summary":"CGA-vw22-3c5m-vmh7","evidence":"osv:CGA-vw22-3c5m-vmh7","products":[{"name":{"value":"hono-service-device-registry-jdbc","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vw22-3c5m-vmh7","aliases":["CGA-vw22-3c5m-vmh7"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-device-registry-jdbc","purl":"pkg:apk/chainguard/hono-service-device-registry-jdbc?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vw22-3c5m-vmh7.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-device-registry-jdbc","component_purl":"pkg:apk/hono-service-device-registry-jdbc@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T13:26:26Z"}]}}],"modified":"2026-10-03T16:12:43.574168112Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0d001921-5a46-4535-9663-e66cc36c418c","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vw22-3c5m-vmh7","advisory_id":"0d001921-5a46-4535-9663-e66cc36c418c","event_types":["advisory"],"published_at":"2026-10-26T04:40:07.598464+00:00","technologies":["core-osv","hono-service-device-registry-jdbc"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:24:00+00:00","detail_url":"/events/76070"}]}},{"id":73635,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-ffcm-46x7-8r63","summary":"CGA-ffcm-46x7-8r63","evidence":"osv:CGA-ffcm-46x7-8r63","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-ffcm-46x7-8r63","aliases":["CGA-ffcm-46x7-8r63"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-ffcm-46x7-8r63.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T12:41:30Z"}]}}],"modified":"2026-10-03T16:12:43.080968234Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0bd07644-8ea4-4b57-a3ac-cd7df6bb8f40","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-ffcm-46x7-8r63","advisory_id":"0bd07644-8ea4-4b57-a3ac-cd7df6bb8f40","event_types":["advisory"],"published_at":"2026-10-26T04:38:46.755057+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:05:51+00:00","detail_url":"/advisories/advisory%3A0bd07644-8ea4-4b57-a3ac-cd7df6bb8f40","group":{"id":"advisory:0bd07644-8ea4-4b57-a3ac-cd7df6bb8f40","revision":1,"primary_event_id":76041,"change":"published","superseded_by":[],"changed":{"id":76041,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-ffcm-46x7-8r63","summary":"CGA-ffcm-46x7-8r63","evidence":"osv:CGA-ffcm-46x7-8r63","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-ffcm-46x7-8r63","aliases":["CGA-ffcm-46x7-8r63"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-ffcm-46x7-8r63.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T12:41:30Z"}]}}],"modified":"2026-10-03T16:12:43.080968234Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0bd07644-8ea4-4b57-a3ac-cd7df6bb8f40","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-ffcm-46x7-8r63","advisory_id":"0bd07644-8ea4-4b57-a3ac-cd7df6bb8f40","event_types":["advisory"],"published_at":"2026-10-26T04:38:46.755057+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:05:51+00:00","detail_url":"/events/76041"},"members":[{"id":76041,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-ffcm-46x7-8r63","summary":"CGA-ffcm-46x7-8r63","evidence":"osv:CGA-ffcm-46x7-8r63","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-ffcm-46x7-8r63","aliases":["CGA-ffcm-46x7-8r63"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-ffcm-46x7-8r63.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T12:41:30Z"}]}}],"modified":"2026-10-03T16:12:43.080968234Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0bd07644-8ea4-4b57-a3ac-cd7df6bb8f40","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-ffcm-46x7-8r63","advisory_id":"0bd07644-8ea4-4b57-a3ac-cd7df6bb8f40","event_types":["advisory"],"published_at":"2026-10-26T04:38:46.755057+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:05:51+00:00","detail_url":"/events/76041"}]}},{"id":73500,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-qh97-rxr3-qxch","summary":"CGA-qh97-rxr3-qxch","evidence":"osv:CGA-qh97-rxr3-qxch","products":[{"name":{"value":"hono-adapter-mqtt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qh97-rxr3-qxch","aliases":["CGA-qh97-rxr3-qxch"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-adapter-mqtt","purl":"pkg:apk/chainguard/hono-adapter-mqtt?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qh97-rxr3-qxch.json"},"ecosystem_specific":{"components":[{"component_name":"hono-adapter-mqtt","component_purl":"pkg:apk/hono-adapter-mqtt@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T13:44:54Z"}]}}],"modified":"2026-10-03T16:12:40.360541301Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e0db6a60-5b1e-4b29-b208-6ccea4af7642","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qh97-rxr3-qxch","advisory_id":"e0db6a60-5b1e-4b29-b208-6ccea4af7642","event_types":["advisory"],"published_at":"2026-10-26T04:33:47.743122+00:00","technologies":["core-osv","hono-adapter-mqtt"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:12:23+00:00","detail_url":"/advisories/advisory%3Ae0db6a60-5b1e-4b29-b208-6ccea4af7642","group":{"id":"advisory:e0db6a60-5b1e-4b29-b208-6ccea4af7642","revision":1,"primary_event_id":75893,"change":"published","superseded_by":[],"changed":{"id":75893,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-qh97-rxr3-qxch","summary":"CGA-qh97-rxr3-qxch","evidence":"osv:CGA-qh97-rxr3-qxch","products":[{"name":{"value":"hono-adapter-mqtt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qh97-rxr3-qxch","aliases":["CGA-qh97-rxr3-qxch"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-adapter-mqtt","purl":"pkg:apk/chainguard/hono-adapter-mqtt?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qh97-rxr3-qxch.json"},"ecosystem_specific":{"components":[{"component_name":"hono-adapter-mqtt","component_purl":"pkg:apk/hono-adapter-mqtt@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T13:44:54Z"}]}}],"modified":"2026-10-03T16:12:40.360541301Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e0db6a60-5b1e-4b29-b208-6ccea4af7642","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qh97-rxr3-qxch","advisory_id":"e0db6a60-5b1e-4b29-b208-6ccea4af7642","event_types":["advisory"],"published_at":"2026-10-26T04:33:47.743122+00:00","technologies":["core-osv","hono-adapter-mqtt"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:12:23+00:00","detail_url":"/events/75893"},"members":[{"id":75893,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-qh97-rxr3-qxch","summary":"CGA-qh97-rxr3-qxch","evidence":"osv:CGA-qh97-rxr3-qxch","products":[{"name":{"value":"hono-adapter-mqtt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qh97-rxr3-qxch","aliases":["CGA-qh97-rxr3-qxch"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-adapter-mqtt","purl":"pkg:apk/chainguard/hono-adapter-mqtt?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qh97-rxr3-qxch.json"},"ecosystem_specific":{"components":[{"component_name":"hono-adapter-mqtt","component_purl":"pkg:apk/hono-adapter-mqtt@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T13:44:54Z"}]}}],"modified":"2026-10-03T16:12:40.360541301Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e0db6a60-5b1e-4b29-b208-6ccea4af7642","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qh97-rxr3-qxch","advisory_id":"e0db6a60-5b1e-4b29-b208-6ccea4af7642","event_types":["advisory"],"published_at":"2026-10-26T04:33:47.743122+00:00","technologies":["core-osv","hono-adapter-mqtt"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:12:23+00:00","detail_url":"/events/75893"}]}},{"id":73409,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-mx7q-ghmp-c6vc","summary":"CGA-mx7q-ghmp-c6vc","evidence":"osv:CGA-mx7q-ghmp-c6vc","products":[{"name":{"value":"hono-cli","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-mx7q-ghmp-c6vc","aliases":["CGA-mx7q-ghmp-c6vc"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-cli","purl":"pkg:apk/chainguard/hono-cli?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mx7q-ghmp-c6vc.json"},"ecosystem_specific":{"components":[{"component_name":"hono-cli","component_purl":"pkg:apk/hono-cli@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T14:49:03Z"}]}}],"modified":"2026-10-03T16:12:38.564621902Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b6df8fb7-eb1a-475a-8d76-cebbeaef04d6","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mx7q-ghmp-c6vc","advisory_id":"b6df8fb7-eb1a-475a-8d76-cebbeaef04d6","event_types":["advisory"],"published_at":"2026-10-26T04:29:35.476075+00:00","technologies":["core-osv","hono-cli"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T14:21:55+00:00","detail_url":"/advisories/advisory%3Ab6df8fb7-eb1a-475a-8d76-cebbeaef04d6","group":{"id":"advisory:b6df8fb7-eb1a-475a-8d76-cebbeaef04d6","revision":1,"primary_event_id":75784,"change":"published","superseded_by":[],"changed":{"id":75784,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-mx7q-ghmp-c6vc","summary":"CGA-mx7q-ghmp-c6vc","evidence":"osv:CGA-mx7q-ghmp-c6vc","products":[{"name":{"value":"hono-cli","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-mx7q-ghmp-c6vc","aliases":["CGA-mx7q-ghmp-c6vc"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-cli","purl":"pkg:apk/chainguard/hono-cli?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mx7q-ghmp-c6vc.json"},"ecosystem_specific":{"components":[{"component_name":"hono-cli","component_purl":"pkg:apk/hono-cli@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T14:49:03Z"}]}}],"modified":"2026-10-03T16:12:38.564621902Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b6df8fb7-eb1a-475a-8d76-cebbeaef04d6","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mx7q-ghmp-c6vc","advisory_id":"b6df8fb7-eb1a-475a-8d76-cebbeaef04d6","event_types":["advisory"],"published_at":"2026-10-26T04:29:35.476075+00:00","technologies":["core-osv","hono-cli"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T14:21:55+00:00","detail_url":"/events/75784"},"members":[{"id":75784,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-mx7q-ghmp-c6vc","summary":"CGA-mx7q-ghmp-c6vc","evidence":"osv:CGA-mx7q-ghmp-c6vc","products":[{"name":{"value":"hono-cli","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-mx7q-ghmp-c6vc","aliases":["CGA-mx7q-ghmp-c6vc"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-cli","purl":"pkg:apk/chainguard/hono-cli?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mx7q-ghmp-c6vc.json"},"ecosystem_specific":{"components":[{"component_name":"hono-cli","component_purl":"pkg:apk/hono-cli@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T14:49:03Z"}]}}],"modified":"2026-10-03T16:12:38.564621902Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b6df8fb7-eb1a-475a-8d76-cebbeaef04d6","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mx7q-ghmp-c6vc","advisory_id":"b6df8fb7-eb1a-475a-8d76-cebbeaef04d6","event_types":["advisory"],"published_at":"2026-10-26T04:29:35.476075+00:00","technologies":["core-osv","hono-cli"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T14:21:55+00:00","detail_url":"/events/75784"}]}},{"id":73383,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-v7j5-x6w4-5x53","summary":"CGA-v7j5-x6w4-5x53","evidence":"osv:CGA-v7j5-x6w4-5x53","products":[{"name":{"value":"hono-service-command-router","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-v7j5-x6w4-5x53","aliases":["CGA-v7j5-x6w4-5x53"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-command-router","purl":"pkg:apk/chainguard/hono-service-command-router?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v7j5-x6w4-5x53.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-command-router","component_purl":"pkg:apk/hono-service-command-router@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T14:57:55Z"}]}}],"modified":"2026-10-03T16:12:37.736139230Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:246277e7-136e-49e2-8473-9e1f6e3575b3","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v7j5-x6w4-5x53","advisory_id":"246277e7-136e-49e2-8473-9e1f6e3575b3","event_types":["advisory"],"published_at":"2026-10-26T04:27:28.675746+00:00","technologies":["core-osv","hono-service-command-router"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:48:26+00:00","detail_url":"/advisories/advisory%3A246277e7-136e-49e2-8473-9e1f6e3575b3","group":{"id":"advisory:246277e7-136e-49e2-8473-9e1f6e3575b3","revision":1,"primary_event_id":75746,"change":"published","superseded_by":[],"changed":{"id":75746,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-v7j5-x6w4-5x53","summary":"CGA-v7j5-x6w4-5x53","evidence":"osv:CGA-v7j5-x6w4-5x53","products":[{"name":{"value":"hono-service-command-router","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-v7j5-x6w4-5x53","aliases":["CGA-v7j5-x6w4-5x53"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-command-router","purl":"pkg:apk/chainguard/hono-service-command-router?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v7j5-x6w4-5x53.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-command-router","component_purl":"pkg:apk/hono-service-command-router@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T14:57:55Z"}]}}],"modified":"2026-10-03T16:12:37.736139230Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:246277e7-136e-49e2-8473-9e1f6e3575b3","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v7j5-x6w4-5x53","advisory_id":"246277e7-136e-49e2-8473-9e1f6e3575b3","event_types":["advisory"],"published_at":"2026-10-26T04:27:28.675746+00:00","technologies":["core-osv","hono-service-command-router"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:48:26+00:00","detail_url":"/events/75746"},"members":[{"id":75746,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-v7j5-x6w4-5x53","summary":"CGA-v7j5-x6w4-5x53","evidence":"osv:CGA-v7j5-x6w4-5x53","products":[{"name":{"value":"hono-service-command-router","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-v7j5-x6w4-5x53","aliases":["CGA-v7j5-x6w4-5x53"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-command-router","purl":"pkg:apk/chainguard/hono-service-command-router?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v7j5-x6w4-5x53.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-command-router","component_purl":"pkg:apk/hono-service-command-router@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T14:57:55Z"}]}}],"modified":"2026-10-03T16:12:37.736139230Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:246277e7-136e-49e2-8473-9e1f6e3575b3","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v7j5-x6w4-5x53","advisory_id":"246277e7-136e-49e2-8473-9e1f6e3575b3","event_types":["advisory"],"published_at":"2026-10-26T04:27:28.675746+00:00","technologies":["core-osv","hono-service-command-router"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:48:26+00:00","detail_url":"/events/75746"}]}},{"id":70971,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"Hono vulnerable to Vary Header Injection leading to potential CORS Bypass","summary":"### Summary A flaw in the CORS middleware allowed request `Vary` headers to be reflected into the response, enabling attacker-controlled `Vary` values and potentially affecting cache behavior. ### Details The middleware previously copied the `Vary` header from the request when `origin` was not set to `\"*\"`. Since `Vary` is a response header that should only be managed by the server, this could allow an attacker to influence caching behavior or cause inconsistent CORS handling. Most environments will see impact only when shared caches or proxies rely on the `Vary` header. The practical effect varies by configuration. ### Impact May cause cache key pollution and inconsistent CORS enforcement in certain setups. No direct confidentiality, integrity, or availability impact in default configurations. ### Resolution Update to the latest patched release. The CORS middleware has been corrected to handle `Vary` exclusively as a response header.","evidence":"osv:GHSA-q7jf-gf43-6x6p","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"GHSA-q7jf-gf43-6x6p","aliases":["CVE-2025-71381","GHSA-q7jf-gf43-6x6p"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.10.3"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-q7jf-gf43-6x6p/GHSA-q7jf-gf43-6x6p.json"}}],"modified":"2026-10-02T18:45:04.883415459Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://github.com/honojs/hono/commit/d9b8b4b73b4f997994f2764013207365fe711282","https://github.com/honojs/hono","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"],"provider_metadata":{"cwe_ids":["CWE-444"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":null,"github_reviewed_at":"2025-10-24T19:15:13Z"}},"related_cves":[{"value":"CVE-2025-71381","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"osv:GHSA-q7jf-gf43-6x6p","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","advisory_id":"0e78e89c-6882-401f-8332-a31da26a2d7b","event_types":["advisory"],"published_at":"2026-10-25T22:45:57.600759+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2025-10-24T19:15:13+00:00","detail_url":"/advisories/osv%3AGHSA-q7jf-gf43-6x6p","group":{"id":"osv:GHSA-q7jf-gf43-6x6p","revision":1,"primary_event_id":71344,"change":"published","superseded_by":[],"changed":{"id":71344,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"Hono vulnerable to Vary Header Injection leading to potential CORS Bypass","summary":"### Summary A flaw in the CORS middleware allowed request `Vary` headers to be reflected into the response, enabling attacker-controlled `Vary` values and potentially affecting cache behavior. ### Details The middleware previously copied the `Vary` header from the request when `origin` was not set to `\"*\"`. Since `Vary` is a response header that should only be managed by the server, this could allow an attacker to influence caching behavior or cause inconsistent CORS handling. Most environments will see impact only when shared caches or proxies rely on the `Vary` header. The practical effect varies by configuration. ### Impact May cause cache key pollution and inconsistent CORS enforcement in certain setups. No direct confidentiality, integrity, or availability impact in default configurations. ### Resolution Update to the latest patched release. The CORS middleware has been corrected to handle `Vary` exclusively as a response header.","evidence":"osv:GHSA-q7jf-gf43-6x6p","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"GHSA-q7jf-gf43-6x6p","aliases":["CVE-2025-71381","GHSA-q7jf-gf43-6x6p"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.10.3"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-q7jf-gf43-6x6p/GHSA-q7jf-gf43-6x6p.json"}}],"modified":"2026-10-02T18:45:04.883415459Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://github.com/honojs/hono/commit/d9b8b4b73b4f997994f2764013207365fe711282","https://github.com/honojs/hono","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"],"provider_metadata":{"cwe_ids":["CWE-444"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":null,"github_reviewed_at":"2025-10-24T19:15:13Z"}},"related_cves":[{"value":"CVE-2025-71381","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"osv:GHSA-q7jf-gf43-6x6p","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","advisory_id":"0e78e89c-6882-401f-8332-a31da26a2d7b","event_types":["advisory"],"published_at":"2026-10-25T22:45:57.600759+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2025-10-24T19:15:13+00:00","detail_url":"/events/71344"},"members":[{"id":71344,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"Hono vulnerable to Vary Header Injection leading to potential CORS Bypass","summary":"### Summary A flaw in the CORS middleware allowed request `Vary` headers to be reflected into the response, enabling attacker-controlled `Vary` values and potentially affecting cache behavior. ### Details The middleware previously copied the `Vary` header from the request when `origin` was not set to `\"*\"`. Since `Vary` is a response header that should only be managed by the server, this could allow an attacker to influence caching behavior or cause inconsistent CORS handling. Most environments will see impact only when shared caches or proxies rely on the `Vary` header. The practical effect varies by configuration. ### Impact May cause cache key pollution and inconsistent CORS enforcement in certain setups. No direct confidentiality, integrity, or availability impact in default configurations. ### Resolution Update to the latest patched release. The CORS middleware has been corrected to handle `Vary` exclusively as a response header.","evidence":"osv:GHSA-q7jf-gf43-6x6p","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"GHSA-q7jf-gf43-6x6p","aliases":["CVE-2025-71381","GHSA-q7jf-gf43-6x6p"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.10.3"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-q7jf-gf43-6x6p/GHSA-q7jf-gf43-6x6p.json"}}],"modified":"2026-10-02T18:45:04.883415459Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://github.com/honojs/hono/commit/d9b8b4b73b4f997994f2764013207365fe711282","https://github.com/honojs/hono","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"],"provider_metadata":{"cwe_ids":["CWE-444"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":null,"github_reviewed_at":"2025-10-24T19:15:13Z"}},"related_cves":[{"value":"CVE-2025-71381","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"osv:GHSA-q7jf-gf43-6x6p","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","advisory_id":"0e78e89c-6882-401f-8332-a31da26a2d7b","event_types":["advisory"],"published_at":"2026-10-25T22:45:57.600759+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2025-10-24T19:15:13+00:00","detail_url":"/events/71344"}]}}],"next_after":74275,"next_before":70971}