hono@4.0.5 vulnerabilities

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to CRLF Injection via the writeSSE function when untrusted input containing carriage return or newline characters is passed to the event, id, or retry fields. An attacker can inject additional Server-Sent Events (SSE) fields within the same event frame by supplying specially crafted input.

Upgrade hono to version 4.12.4 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Improper Handling of URL Encoding (Hex Encoding) via inconsistent URL decoding between the serveStatic process and route-based middleware protections. An attacker can access protected static resources without authorization by requesting paths with encoded slashes - e.g. /admin%2Fsecret.html.

Note: This vulnerability specifically affects applications that rely solely on route-based middleware to protect static subpaths.

Upgrade hono to version 4.12.4 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to CRLF Injection via the setCookie() utility. An attacker can inject unauthorized cookie attributes by supplying specially crafted input containing semicolons, carriage returns, or newline characters in the domain or path fields.

Notes:

• Successful exploitation requires the application to pass user-controlled input directly into the domain or path options of setCookie()
• This issue is limited to attribute-level manipulation within a single Set-Cookie header.

Upgrade hono to version 4.12.4 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Timing Attack via the timingSafeEqual() function. An attacker can infer sensitive information by performing timing analysis attacks during authentication comparisons.

Upgrade hono to version 4.11.10 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via improper handling of HTTP cache control directives, including Cache-Control: private and Cache-Control: no-store. An attacker can access sensitive information by sending unauthenticated requests that receive cached responses intended for authenticated users.

Upgrade hono to version 4.11.7 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Incorrect Authorization via improper validation of user-supplied paths in the serve-static middleware. An attacker can access internal asset keys by crafting requests that bypass intended path restrictions. This is only exploitable if the application is running on Cloudflare Workers and uses the Serve static Middleware with user-controllable request paths.

Upgrade hono to version 4.11.7 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the ErrorBoundary component of the jsx library, when untrusted user-controlled strings are rendered as raw HTML. An attacker can execute scripts in the victim's browser.

Upgrade hono to version 4.11.7 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Incorrect Regular Expression in the form of the IPV4_REGEX pattern not properly matching IPv4 octet ranges, and passing values above 255 on to convertIPv4ToBinary. An attacker can gain unauthorized access or bypass IP-based restrictions by submitting malicious IP addresses, such as via the X-Forwarded-For header. Applications that rely on these values for access control decisions are vulnerable.

Upgrade hono to version 4.11.7 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm due to the JWT verification middleware using unsafe default fallback algorithm. An attacker can gain unauthorized access or escalate privileges by crafting JWTs with manipulated alg header values and force the middleware to use default HS256 algorithm for verification.

Note:

Users that configured their app without JWK/JWKS middleware or explicitly restrict allowed algorithms are not affected.

Upgrade hono to version 4.11.4 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the JWT verification middleware fallback on unverified JWT header when alg field is not present. An attacker can gain unauthorized access or escalate privileges by crafting JWTs with manipulated alg header values and force the middleware to use unsafe symmetric algorithms for verification.

Note:

Users that configured their app without JWK/JWKS middleware or explicitly restrict allowed algorithms are not affected.

Upgrade hono to version 4.11.4 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to HTTP Request Smuggling via the CORS middleware, which copies the Vary header from the request to the response when the origin is not set to "*". An attacker can influence cache behavior or cause inconsistent cross-origin resource sharing enforcement by supplying crafted Vary headers in requests.

Note: This is exploitable if shared caches or proxies rely on the Vary header for cache key calculation.

Upgrade hono to version 4.10.3 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Unverified Ownership via the JWT authentication process. An attacker can gain unauthorized access to protected resources by presenting a valid token intended for a different audience when multiple services share the same issuer or keys.

Upgrade hono to version 4.10.2 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to HTTP Request Smuggling via the bodyLimit middleware when conflicting HTTP headers are present. An attacker can cause excessive memory or CPU consumption by sending oversized request bodies that bypass the configured size limit.

Note: This is exploitable if the deployment environment or runtime does not reject requests with both Content-Length and Transfer-Encoding: chunked headers.

Upgrade hono to version 4.9.7 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) through the csrf function. An attacker can bypass CSRF protection by sending a request without a Content-Type header.

Upgrade hono to version 4.6.5 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Cross-Site Request Forgery (CSRF) via the isRequestedByFormElementRe function. An attacker can bypass CSRF protection by using a crafted Content-Type header with case manipulation.

Upgrade hono to version 4.5.8 or higher.