High severity · published Apr 19, 2024
CVE-2024-32652
@hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
The adapter @hono/node-server allows you to run your Hono application on Node.js. Prior to 1.10.1, the application hangs when receiving a Host header with a value that `@hono/node-server` can't handle well. Invalid values are those that cannot be parsed by the `URL` as a hostname such as an empty string, slashes `/`, and other strings. The version 1.10.1 includes the fix for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
node-server · honojs
>= 1.3.0, < 1.10.1 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-32652
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-32652
Patch
https://github.com/honojs/node-server/commit/d847e60249fd8183ba0998bc379ba20505643204
Exploit
https://github.com/honojs/node-server/issues/159
Vendor Advisory
https://github.com/honojs/node-server/security/advisories/GHSA-hgxw-5xg3-69jx
More from node-server
7.5
CVE-2026-29087
@hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
5.3
CVE-2026-118663
@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
5.3
CVE-2026-73565
@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake
5.3
CVE-2026-39406
@hono/node-server has a middleware bypass via repeated slashes in serveStatic
5.3
CVE-2024-23340
@hono/node-server can't handle "double dots" in URL