Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2024-32652

@hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed

Description

The adapter @hono/node-server allows you to run your Hono application on Node.js. Prior to 1.10.1, the application hangs when receiving a Host header with a value that `@hono/node-server` can't handle well. Invalid values are those that cannot be parsed by the `URL` as a hostname such as an empty string, slashes `/`, and other strings. The version 1.10.1 includes the fix for this issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

honojs node-server

  • >= 1.3.0, < 1.10.1affected

References