CVE-2026-59903 is a medium severity information disclosure in Netty. CorsHandler replaces application Vary headers such as Authorization or Cookie with Origin, so a caching proxy or CDN may reuse an authenticated response across users. Fixed in Netty 4.1.137.Final and 4.2.17.Final.
What's affected
- Product: Netty, class
io.netty.handler.codec.http.cors.CorsHandler. - Affected: versions before 4.1.137.Final, and before 4.2.17.Final in the 4.2 line.
- Fixed: 4.1.137.Final and 4.2.17.Final.
- Exposed: services that use CorsHandler, and sit behind a shared cache, proxy or CDN.
How to check if you're exposed
Find the Netty version your application resolves, including copies pulled in by frameworks.
mvn dependency:tree -Dincludes=io.netty
./gradlew dependencies --configuration runtimeClasspath | grep -i netty
Then check whether you use CorsHandler, directly or through a framework that builds on Netty. Finally, look at your response headers on a real request with credentials. If your application sets Vary values and you see only Origin in the response, the header was overwritten.
What to do now
- Upgrade Netty to 4.1.137.Final or 4.2.17.Final, or to a framework release that includes it.
- Until then, add the Vary values you need at a layer after CorsHandler, for example in a reverse proxy.
- Mark responses that depend on credentials as Cache-Control private or no-store.
- Check that your CDN does not cache authenticated responses by default.
- Run the free in-browser dependency scan on your lockfile or manifest to see every affected package in one pass.
Why it matters
The weakness is CWE-524 (Use of Cache Containing Sensitive Information). The Netty pull request describes it as the CORS handler silently overwriting an existing Vary header. The Vary header tells caches which request headers change the response. If Authorization or Cookie is dropped from it, a cache may serve one user's response to another.
The condition is a shared cache in front of the service, and the record rates attack complexity as high, which is why it scores 6.5 (Medium). Where the condition holds, the leaked content is whatever the authenticated response contained. The fix is to set the Vary header only if it does not already exist. The record does not mark it as exploited in the wild.
Try it yourself
Netty ships inside many frameworks, so version bumps often arrive through a pull request. This demo shows a pull request gate blocking a vulnerable dependency.
Click through it at your own pace, or open it full screen.
Quick check
What does the Vary header do?
It lists the request headers that change the response, so caches know when they may not reuse a stored copy. Replacing it with Origin hides the Authorization or Cookie dependency.
Sources
Last reviewed: 18 October 2026.
