PT-2024-24746 · Npm · @Hono/Node-Server

Yusukebe · Published 2024-04-19 · Updated 2026-03-13 · CVE-2024-32652

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions @hono/node-server versions prior to 1.10.1

Description The application hangs when receiving a Host header with a value that @hono/node-server can't handle well. Invalid values are those that cannot be parsed by the URL as a hostname, such as an empty string, slashes /, and other strings.

Recommendations For versions prior to 1.10.1, update to version 1.10.1 or later to resolve the issue. It is recommended to use version 1.11.0, which includes additional fixes related to this issue.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2024-32652

GHSA-HGXW-5XG3-69JX

Affected Products

@Hono/Node-Server

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32652.json · Exploit
• 🔥 https://github.com/honojs/node-server/issues/159 · Exploit
• https://github.com/honojs/node-server/security/advisories/GHSA-hgxw-5xg3-69jx · Vendor Advisory
• https://github.com/honojs/node-server/commit/d847e60249fd8183ba0998bc379ba20505643204 · Patch
• https://osv.dev/vulnerability/GHSA-hgxw-5xg3-69jx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32652 · Security Note
• https://osv.dev/vulnerability/CVE-2024-32652 · Vendor Advisory
• https://github.com/honojs/node-server · Note
• https://github.com/honojs/node-server/issues/161 · Note
• https://github.com/honojs/node-server/commit/306d98f02a8671a0a1fb91ac8fe7e281690c05af · Note
• https://twitter.com/dailycve/status/2032275424945066131 · Twitter Post
• https://t.me/cveNotify/135721 · Telegram Post
• https://t.me/cvenotify/77614 · Telegram Post
• https://t.me/cvenotify/77513 · Telegram Post