CVE-2024-32652
The adapter @hono/node-server allows you to run your Hono application on Node.js. Prior to 1.10.1, the application hangs when receiving a Host header with a value that `@hono/node-server` can't handle well. Invalid values are those that cannot be parsed by the `URL` as a hostname such as an empty string, slashes `/`, and other strings. The version 1.10.1 includes the fix for this issue.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS probability
- 0.88%
- CWE
- CWE-755
- Published
- 2024-04-19
- Last modified
- 2026-03-13
Affected products
- honojs node-server
Weakness type
Related vulnerabilities
- CVE-2026-49305 — Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful exploitation...
- CVE-2026-45819 — baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or...
- CVE-2026-52856 — Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service
- CVE-2026-59952 — Valibot: record() issue paths can make flatten() throw for inherited Object property names
- CVE-2026-42792 — epmd permanent DoS via EMFILE on accept(2) in erts
- CVE-2026-48036 — Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts
- CVE-2026-16730 — Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup
- CVE-2026-62994 — CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin