node-server security vulnerability

node-server is an adapter that allows users to run Hono applications on Node.js. A security vulnerability exists in node-server versions prior to 1.10.1 that stems from a denial-of-service risk when receiving an unresolvable Host header...

CVE-2024-32652: Improper Handling of Exceptional Conditions

The adapter @hono/node-server allows you to run your Hono application on Node.js. Prior to 1.10.1, the application hangs when receiving a Host header with a value that @hono/node-server can't handle well. Invalid values are those that cannot be parsed by the URL as a hostname such as an empty...

Node.js HTTP Server DoS

The vulnerability of the HTTP server in the Node.js software platform is related to an uncontrolled resource consumption caused by reading an unlimited number of bytes from a single connection when processing HTTP requests with fragmented encoding. Exploiting this vulnerability allows a remote...

SUSE CVE-2024-27983

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a T...

Path Traversal

@hono/node-server is vulnerable to Path Traversal. The vulnerability is due to improper url string validation in src/request.ts, allowing an attacker to use .. in the request URL to access arbitrary files on the static server...

@zemble/node (>=0.0.11, <=0.0.14), waku (>=0.19.0-alpha.2, <=0.19.1) potentially affected by CVE-2024-23340 via @hono/node-server (>=1.3.3, <=1.4.0)

@hono/node-server NPM version =1.3.3, =0.0.11, =0.19.0-alpha.2, =0.19.1 Source cves: CVE-2024-23340 Source advisory: OSV:GHSA-RJQ5-W47X-X359...

@zemble/node (>=0.0.11, <=0.0.14), waku (>=0.19.0-alpha.2, <=0.19.1) potentially affected by CVE-2024-23340 via @hono/node-server (>=1.3.3, <=1.4.0)

@hono/node-server NPM version =1.3.3, =0.0.11, =0.19.0-alpha.2, =0.19.1 Source cves: CVE-2024-23340 Source advisory: GHSA-RJQ5-W47X-X359...

CVE-2024-23340

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with url behavior that is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request...

Design/Logic Flaw

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with url behavior that is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request...

CVE-2024-23340

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with "url" behavior that is unexpected. In the standard API, if the URL contains "..", here called "double dots", the URL string returned by Reque...

CVE-2024-23340 @hono/node-server can't handle "double dots" in URL

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with url behavior that is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request...

CVE-2024-23340 @hono/node-server can't handle "double dots" in URL

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with url behavior that is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request...

CVE-2024-23340

The CVE concerns @hono/node-server (Node.js adapter) where its custom Request.url does not resolve ". ." (double dots), causing un-resolved paths like http://localhost/static/.. /foo.txt to be passed to serveStatic. This path-traversal can enable access to unintended files on the static server, u...

@zemble/node (>=0.0.11, <=0.0.14), waku (>=0.19.0-alpha.2, <=0.19.1) potentially affected by CVE-2024-23340 via @hono/node-server (>=1.3.3, <=1.4.0)

@hono/node-server NPM version =1.3.3, =0.0.11, =0.19.0-alpha.2, =0.19.1 Source cves: CVE-2024-23340 Source advisory: MEND:CVE-2024-23340...

node-server path traversal vulnerability

node-server is an adapter that allows users to run Hono applications on Node.js. A path traversal vulnerability exists in node-server version 1.3.0 through versions prior to 1.4.1, which stems from an inability to resolve double dots in a URL...

PT-2024-19820

Name of the Vulnerable Software and Affected Versions @hono/node-server versions 1.3.0 through 1.4.0 Description The issue arises from the url behavior in @hono/node-server's Request object, which does not resolve "double dots" .. in URLs, potentially leading to vulnerabilities when using...

CVE-2024-23340: Improper Limitation of a Pathname to a Restricted Directory

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with url behavior that is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request...

Path Traversal

web-node-server is vulnerable to Path Traversal. The vulnerability is due to to a lack of sanitization of relative file paths in the start function of nodeserver.js which allows an attacker to write arbitrary files outside the expected directory...

Malicious code in seal_online_node_server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7bf0243aa25b356dbd5d2f2018019d81b39aa0ce936772bd7aa1761a1c306b85 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5987 Malicious code in seal_online_node_server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7bf0243aa25b356dbd5d2f2018019d81b39aa0ce936772bd7aa1761a1c306b85 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...