[GHSA] GHSA-8j4g-w8fx-2239 (medium) — Hono: ReDoS in CORS middleware via Access-Control-Request-Headers

GHSA-8j4g-w8fx-2239 Severity: medium CVE: CVE-2026-69207

Hono: ReDoS in CORS middleware via Access-Control-Request-Headers

### Summary

The built-in CORS middleware (`hono/cors`) parses the attacker-controlled `Access-Control-Request-Headers` request header during a preflight (`OPTIONS`) request using a regular expression whose running time is quadratic in the input length. A single request carr