Security vulnerabilities and automated fixes for cors issues
6 posts found
The `hono` CORS middleware, as resolved in this service at 4.12.8, reflected the caller's `Origin` header back in `Access-Control-Allow-Origin` while also emitting `Access-Control-Allow-Credentials: true` whenever the `origin` option was left at its `'*'` default. That combination makes any website a trusted origin for credentialed cross-origin reads. The dependency range was raised from `^4.7.1` to `^4.13.5`, moving the installed copy from 4.12.8 to 4.13.5.
CVE-2026-54290 is a HIGH severity CORS misconfiguration in the Hono web framework where the CORS middleware incorrectly reflects any `Origin` header back to the client — including credentials — when the `origin` option defaults to a wildcard. Upgrading `hono` from `4.12.16` to `4.12.34` in `package-lock.json` and pinning the version via `overrides` in `package.json` closes the vulnerability. Left unpatched, this flaw could allow malicious cross-origin sites to make credentialed requests and read
A critical vulnerability in `script.js` was making unauthenticated HTTPS POST requests to an external summarization service without proper CORS controls or credential isolation, leaving users on compromised networks exposed to man-in-the-middle attacks. The fix adds explicit `mode: 'cors'` and `credentials: 'omit'` to the fetch call, ensuring the browser enforces cross-origin restrictions and prevents unintended credential leakage. This is especially significant because the affected code is part
A FastAPI application serving as a MyShows proxy was configured to allow all origins with credentials enabled, creating a dangerous CORS misconfiguration that could let any malicious website silently harvest authentication tokens. The fix was a single-line change — setting `allow_credentials=False` — but the implications of leaving it unchecked were significant. This post breaks down exactly how the vulnerability works, why FastAPI's behavior makes it subtler than it first appears, and how to co
A critical security vulnerability in the `/changeData` endpoint allowed any remote attacker to modify user data without authorization. The Express.js route handler accepted requests from any origin and passed user-supplied data directly to the `changeData()` function. The fix implements origin validation using a regex pattern to restrict requests to trusted local sources only.
A high-severity CORS misconfiguration in Hono's middleware (CVE-2026-54290) allowed any origin to be reflected with credentials when the `origin` option defaulted to wildcard. This vulnerability in the studio frontend could enable attackers to steal authenticated user data through cross-origin requests. The fix upgrades Hono from 4.12.21 to 4.12.25, which properly handles CORS origin validation.