CVE-2026-44457

{
  "id": "CVE-2026-44457",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-13T16:16:57.700",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Vary: Authorization or Vary: Cookie. As a result, a response cached for one authenticated user may be served to subsequent requests from different users. This vulnerability is fixed in 4.12.18."
    },
    {
      "lang": "es",
      "value": "Hono es un framework de aplicación web que proporciona soporte para cualquier entorno de ejecución de JavaScript. Antes de la 4.12.18, el Middleware de caché no omite el almacenamiento en caché para las respuestas que declaran varianza por usuario a través de Vary: Authorization o Vary: Cookie. Como resultado, una respuesta almacenada en caché para un usuario autenticado puede ser entregada a solicitudes posteriores de diferentes usuarios. Esta vulnerabilidad está corregida en la 4.12.18."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "honojs",
          "product": "hono",
          "versions": [
            {
              "version": "< 4.12.18",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-18T14:06:33.297435Z",
          "id": "CVE-2026-44457",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-524"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:hono:hono:*:*:*:*:*:node.js:*:*",
              "versionEndExcluding": "4.12.18",
              "matchCriteriaId": "5AB1A6FC-8475-4A23-9E63-46F3E6C5D264"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/honojs/hono/security/advisories/GHSA-p77w-8qqv-26rm",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}