@backan/core (>=0.0.3, <=0.0.19), @bepp/api (>=1.3.2, <=1.3.17) +38 more potentially affected by CVE-2024-43787 via hono (>=4.0.0, <=4.5.7)

hono NPM version =4.0.0, =0.0.3, =1.3.2, =2.1.5, =0.1.0, =2.13.0, =1.2.0, =1.0.1, =0.0.1, =1.0.0-apm.0, =0.0.0-next-20240721155721, =0.1.0, =0.82.2-rc.1, =0.82.2-rc.1, =0.82.2-rc.1, =0.96.0 and more Source cves: CVE-2024-43787 Source advisory: OSV:GHSA-RPFR-3M35-5VX5...

CVE-2024-43787 Hono CSRF middleware can be bypassed using crafted Content-Type header

Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. As a result, attacker can bypass csrf middleware...