CVE-2024-32652: Improper Handling of Exceptional Conditions

The adapter @hono/node-server allows you to run your Hono application on Node.js. Prior to 1.10.1, the application hangs when receiving a Host header with a value that @hono/node-server can't handle well. Invalid values are those that cannot be parsed by the URL as a hostname such as an empty...

PT-2024-24746

Name of the Vulnerable Software and Affected Versions @hono/node-server versions prior to 1.10.1 Description The application hangs when receiving a Host header with a value that @hono/node-server can't handle well. Invalid values are those that cannot be parsed by the URL as a hostname, such as a...

@zemble/node (>=0.0.11, <=0.0.14), waku (>=0.19.0-alpha.2, <=0.19.1) potentially affected by CVE-2024-23340 via @hono/node-server (>=1.3.3, <=1.4.0)

@hono/node-server NPM version =1.3.3, =0.0.11, =0.19.0-alpha.2, =0.19.1 Source cves: CVE-2024-23340 Source advisory: OSV:GHSA-RJQ5-W47X-X359...

CVE-2024-23340

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with url behavior that is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request...

Design/Logic Flaw

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with url behavior that is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request...

CVE-2024-23340 @hono/node-server can't handle "double dots" in URL

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with url behavior that is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request...

CVE-2024-23340

The CVE concerns @hono/node-server (Node.js adapter) where its custom Request.url does not resolve ". ." (double dots), causing un-resolved paths like http://localhost/static/.. /foo.txt to be passed to serveStatic. This path-traversal can enable access to unintended files on the static server, u...

CVE-2024-23340

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with "url" behavior that is unexpected. In the standard API, if the URL contains "..", here called "double dots", the URL string returned by Reque...

CVE-2024-23340 @hono/node-server can't handle "double dots" in URL

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with url behavior that is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request...

CVE-2024-23340 @hono/node-server can't handle "double dots" in URL

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with url behavior that is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request...

CVE-2024-23340: Improper Limitation of a Pathname to a Restricted Directory

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with url behavior that is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request...

PT-2024-19820

Name of the Vulnerable Software and Affected Versions @hono/node-server versions 1.3.0 through 1.4.0 Description The issue arises from the url behavior in @hono/node-server's Request object, which does not resolve "double dots" .. in URLs, potentially leading to vulnerabilities when using...

Code Injection

hono is vulnerable to Code Injection. The vulnerability is due to gHSets method lacking isolation in the handler set parameters for each request. An attacker can potentially exploit this by overriding named path parameters from previous requests, leading to unintended parameter usage in subsequen...

Named path parameters can be overridden in TrieRouter

Impact The clients may override named path parameter values from previous requests if the application is using TrieRouter. So, there is a risk that a privileged user may use unintended parameters when deleting REST API resources. TrieRouter is used either explicitly or when the application matche...

Arbitrary Code Injection

Overview org.webjars.npm:hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Arbitrary Code Injection via the TrieRouter process. An attacker can manipulate the path parameters to override named path parameter values from previous requests,...

@arakoodev/edgechains.js (>=0.1.24, <=0.30.1), @hono/zod-validator (0.0.2) +20 more potentially affected by CVE-2023-50710 via hono (>=3.0.0-rc.7, <=3.10.1)

hono NPM version =3.0.0-rc.7, =0.1.24, =0.0.1-alpha.1, =0.0.1-alpha.10, =0.0.1-alpha.10, =0.0.1-alpha.10, =0.0.1-alpha.0, =0.0.1, =0.0.2-alpha.15, =0.0.1-alpha.4, =0.0.1-alpha.6, =0.0.2-alpha.20, =0.0.1-alpha.0, =0.0.1-alpha.4, =0.0.2-alpha.23 and more Source cves: CVE-2023-50710 Source advisory:...

GHSA-F6GV-HH8J-Q8VQ Named path parameters can be overridden in TrieRouter

Impact The clients may override named path parameter values from previous requests if the application is using TrieRouter. So, there is a risk that a privileged user may use unintended parameters when deleting REST API resources. TrieRouter is used either explicitly or when the application matche...

Improper Control of Generation of Code ('Code Injection')

Overview org.webjars.npm:hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Improper Control of Generation of Code 'Code Injection' due to the use of TrieRouter or when matching patterns not supported by the default RegExpRouter. An attacker can...

CVE-2023-50710

Hono is a web framework written in TypeScript. Prior to version 3.11.7, clients may override named path parameter values from previous requests if the application is using TrieRouter. So, there is a risk that a privileged user may use unintended parameters when deleting REST API resources...

CVE-2023-50710

Hono is a web framework written in TypeScript. Prior to version 3.11.7, clients may override named path parameter values from previous requests if the application is using TrieRouter. So, there is a risk that a privileged user may use unintended parameters when deleting REST API resources...