GHSA-88fw-hqm2-52qc found in npm/hono@4.12.19

## GHSA-88fw-hqm2-52qc found in npm/hono@4.12.19 
> [!important] 
> **Risk**: `2.60 (Low)`
> **CVSS**: `7.1` 
### Description
### Summary

With `credentials: true` and no explicit `origin` (the default wildcard), the CORS Middleware reflects the request's `Origin` and sends `Access-Control-Allow-Credentials: true`. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins.

### Details

The spec forbids `Access-Control-Allow-Origin: *` with credentials and browsers reject it, so this configuration used to fail closed. In affected versions the middleware reflects the request `Origin` instead, so it now succeeds for every origin, including `null`. The preflight also echoes the requested headers back, approving non-simple credentialed requests too.

This issue arises when an application enables `credentials: true` and leaves `origin` unset or set to the wildcard.

### Impact

Any third-party page a logged-in user visits can read the application's cookie-authenticated endpoints and perform credentialed state-changing requests. This affects applications that enable credentialed CORS without restricting `origin`.
### Affected component 
The vulnerability is in `pkg:npm/hono@4.12.19`, found in artifacts `pkg:oci/l3montree-cybersecurity/devguard/devguard-documentation`.
### Recommended fix
Upgrade to version 4.12.25 or later.
```
# Update all vulnerable npm packages
npm audit fix
# Update only this package
npm install hono@4.12.25 
```
### Additional guidance for mitigating vulnerabilities
Visit our guides on [devguard.org](https://devguard.org/risk-mitigation-guides/software-composition-analysis)

<details>

<summary>See more details...</summary>

### Path to component
```mermaid 
 %%{init: { 'theme':'base', 'themeVariables': {
'primaryColor': '#F3F3F3',
'primaryTextColor': '#0D1117',
'primaryBorderColor': '#999999',
'lineColor': '#999999',
'secondaryColor': '#ffffff',
'tertiaryColor': '#ffffff'
} }}%%
 flowchart TD
Your_application(["Your application"]) --- pkg_npm_hono_4_12_19(["pkg:npm/hono\@4.12.19"])

classDef default stroke-width:2px
```
| Risk Factor | Value | Description | 
| ---- | ----- | ----------- | 
| Vulnerability Depth | `1` | The vulnerability is in a direct dependency of your project. | 
| EPSS | `0.00 %` | The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days. | 
| EXPLOIT | `Not available` | We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database. There are no script kiddies exploiting this vulnerability. | 
| CVSS-BE | `5.7` | - Exploiting this vulnerability significantly impacts confidentiality. | 
| CVSS-B | `7.1` | - The vulnerability can be exploited over the network without needing physical access. - It is easy for an attacker to exploit this vulnerability. - An attacker does not need any special privileges or access rights. - The attacker needs the user to perform some action, like clicking a link. - The impact is confined to the system where the vulnerability exists. - There is a high impact on the confidentiality of the information. - There is a low impact on the integrity of the data. | 

More details can be found in [DevGuard](https://main.devguard.org/l3montree-cybersecurity/projects/devguard/assets/devguard-documentation/refs/main/dependency-risks/5917d329-1bce-119d-c67a-9a737ee14b17)

</details>


--- 
### Interact with this vulnerability
You can use the following slash commands to interact with this vulnerability:

#### 👍 Reply with this to acknowledge and accept the identified risk.
```text
/accept I accept the risk of this vulnerability, because ...
```

#### ⚠️ Mark the risk as false positive: Use one of these commands if you believe the reported vulnerability is not actually a valid issue.
```text
/component-not-present The vulnerable component is not included in the artifact.
```
```text
/vulnerable-code-not-present The component is present, but the vulnerable code is not included or compiled.
```
```text
/vulnerable-code-not-in-execute-path The vulnerable code exists, but is never executed at runtime.
```
```text
/vulnerable-code-cannot-be-controlled-by-adversary Built-in protections prevent exploitation of this vulnerability.
```
```text
/inline-mitigations-already-exist The vulnerable code cannot be controlled or influenced by an attacker.
```

#### 🔁 Reopen the risk: Use this command to reopen a previously closed or accepted vulnerability.
```text
/reopen ... 
```

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

GHSA-88fw-hqm2-52qc found in npm/hono@4.12.19 #157