CVE-2024-32652 @hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed

The adapter @hono/node-server allows you to run your Hono application on Node.js. Prior to 1.10.1, the application hangs when receiving a Host header with a value that @hono/node-server can't handle well. Invalid values are those that cannot be parsed by the URL as a hostname such as an empty...

CVE-2024-32652 @hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed

The adapter @hono/node-server allows you to run your Hono application on Node.js. Prior to 1.10.1, the application hangs when receiving a Host header with a value that @hono/node-server can't handle well. Invalid values are those that cannot be parsed by the URL as a hostname such as an empty...

CVE-2024-32652

Summary: CVE-2024-32652 affects the Node.js adapter @hono/node-server. Before version 1.10.1, handling of invalid Host header values (e.g., empty strings or values not parseable as a hostname) could cause the application to hang via an Invalid URL error. The advisory states that 1.10.1 fixes the ...

PT-2024-24746

Name of the Vulnerable Software and Affected Versions @hono/node-server versions prior to 1.10.1 Description The application hangs when receiving a Host header with a value that @hono/node-server can't handle well. Invalid values are those that cannot be parsed by the URL as a hostname, such as a...

node-server 安全漏洞

node-server is an adapter that allows users to run Hono applications on Node.js. A security vulnerability exists in node-server versions prior to 1.10.1 that stems from a denial-of-service risk when receiving an unresolvable Host header...

The vulnerability of the HTTP-server in the Node.js software platform allows attackers to circumvent security restrictions and cause service failures.

The vulnerability of the HTTP server in the Node.js software platform is related to an uncontrolled resource consumption caused by reading an unlimited number of bytes from a single connection when processing HTTP requests with fragmented encoding. Exploiting this vulnerability allows a remote...

SUSE CVE-2024-27983

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a T...

Path Traversal

@hono/node-server is vulnerable to Path Traversal. The vulnerability is due to improper url string validation in src/request.ts, allowing an attacker to use .. in the request URL to access arbitrary files on the static server...

@zemble/node (>=0.0.11 <=0.0.14), waku (>=0.19.0 <=0.19.1) potentially affected by CVE-2024-23340 via @hono/node-server (>=1.3.3 <=1.4.0)

@hono/node-server NPM version =1.3.3, =0.0.11, =0.19.0, =0.19.1 Source cves: CVE-2024-23340 Source advisory: OSV:GHSA-RJQ5-W47X-X359...

CVE-2024-23340

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with url behavior that is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request...

Design/Logic Flaw

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with url behavior that is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request...

CVE-2024-23340 @hono/node-server can't handle "double dots" in URL

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with url behavior that is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request...

CVE-2024-23340

The CVE concerns @hono/node-server (Node.js adapter) where its custom Request.url does not resolve ". ." (double dots), causing un-resolved paths like http://localhost/static/.. /foo.txt to be passed to serveStatic. This path-traversal can enable access to unintended files on the static server, u...

CVE-2024-23340 @hono/node-server can't handle "double dots" in URL

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with url behavior that is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request...

node-server path traversal vulnerability

node-server is an adapter that allows users to run Hono applications on Node.js. A path traversal vulnerability exists in node-server version 1.3.0 through versions prior to 1.4.1, which stems from an inability to resolve double dots in a URL...

Path Traversal

web-node-server is vulnerable to Path Traversal. The vulnerability is due to to a lack of sanitization of relative file paths in the start function of nodeserver.js which allows an attacker to write arbitrary files outside the expected directory...

Malicious code in seal_online_node_server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7bf0243aa25b356dbd5d2f2018019d81b39aa0ce936772bd7aa1761a1c306b85 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5987 Malicious code in seal_online_node_server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7bf0243aa25b356dbd5d2f2018019d81b39aa0ce936772bd7aa1761a1c306b85 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-WM7H-9275-46V2 Crash in HeaderParser in dicer

This affects all versions of the package dicer. A malicious attacker can send a modified form to the server and crash the Node.js service. A complete denial of service can be achieved by sending the malicious form in a loop...

Node.js: HTTP Request Smuggling Due To Improper Delimiting of Header Fields

Summary: The llhttp parser in the http module in Node v17.8.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS. Description: The LF character without CR is sufficient to delimit HTTP header fields in the lihttp parser. According to...