CVE-2026-69207: Hono Cors Redos Split

Splitting strings using a regex with whitespace tolerance like `/\s*,\s*/` can cause Regular Expression Denial of Service (ReDoS) when processing long inputs without commas. Use literal string splitting with `.split(',')` followed by `.map(s => s.trim())` instead.

Provally CuratedPublic repositoryMediumMedium confidenceVerifiedApache-2.0JS
greprules fetch cve-2026-69207-hono-cors-redos-split --engine opengrep

Description

Splitting strings using a regex with whitespace tolerance like `/\s*,\s*/` can cause Regular Expression Denial of Service (ReDoS) when processing long inputs without commas. Use literal string splitting with `.split(',')` followed by `.map(s => s.trim())` instead.