VulnerabilityAnalyzed
CVE-2024-32652
The adapter @hono/node-server allows you to run your Hono application on Node.js.
HIGH 7.5EPSS 0.88%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.88%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The adapter @hono/node-server allows you to run your Hono application on Node.js. Prior to 1.10.1, the application hangs when receiving a Host header with a value that `@hono/node-server` can't handle well. Invalid values are those that cannot be parsed by the `URL` as a hostname such as an empty string, slashes `/`, and other strings. The version 1.10.1 includes the fix for this issue.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.88% probability · 57th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-755
- Affected
- hono/node-server
- Source
- security-advisories@github.com
References
- https://github.com/honojs/node-server/commit/d847e60249fd8183ba0998bc379ba20505643204Patch
- https://github.com/honojs/node-server/issues/159Exploit, Issue Tracking, Third Party Advisory
- https://github.com/honojs/node-server/security/advisories/GHSA-hgxw-5xg3-69jxVendor Advisory
- https://github.com/honojs/node-server/commit/d847e60249fd8183ba0998bc379ba20505643204Patch
- https://github.com/honojs/node-server/issues/159Exploit, Issue Tracking, Third Party Advisory
- https://github.com/honojs/node-server/security/advisories/GHSA-hgxw-5xg3-69jxVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.