Detections
Analytics

SCA: security update for hono (GHSA-8j4g-w8fx-2239)

medium Tenable Self-Hosted Container Security Plugin ID 445613

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34,
 the built-in CORS middleware, hono/cors, is vulnerable to a regular expression denial of service (ReDoS).
 During a preflight OPTIONS request, the middleware parses the attacker-controlled Access-Control-Request-
 Headers header using a whitespace-tolerant regular expression whose backtracking makes its running time
 quadratic in the input length. Because the header value is bounded only by the deployment's maximum HTTP
 header size, a single preflight carrying a long run of whitespace can consume seconds of CPU and block
 request processing. On runtimes that share one execution thread across requests, this stalls concurrent
 requests as well, and repeated requests can render the service unresponsive. This affects the default
 configuration, since the vulnerable path is reached whenever cors() is used with an unset or empty
 allowHeaders. Applications that set a non-empty allowHeaders are not affected. This issue is fixed in
 version 4.12.34. (CVE-2026-69207)

Solution

Update the hono library and its related packages to version 4.12.34 or later.

See Also

https://github.com/advisories/GHSA-8j4g-w8fx-2239

Plugin Details

Severity: Medium

ID: 445613

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 8/4/2026

Updated: 8/10/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-69207

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/3/2026

Vulnerability Publication Date: 8/3/2026

Reference Information

CVE: CVE-2026-69207