CVE-2024-32652

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-32652
The adapter @hono/node-server allows you to run your Hono application on Node.js. Prior to 1.10.1, the application hangs when receiving a Host header with a value that `@hono/node-server` can't handle well. Invalid values are those that cannot be parsed by the `URL` as a hostname such as an empty string, slashes `/`, and other strings. The version 1.10.1 includes the fix for this issue.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/honojs/node-server/commit/d847e60249fd8183ba0998bc379ba20505643204 Patch
https://github.com/honojs/node-server/issues/159 Exploit Issue Tracking Third Party Advisory
https://github.com/honojs/node-server/security/advisories/GHSA-hgxw-5xg3-69jx Vendor Advisory
https://github.com/honojs/node-server/commit/d847e60249fd8183ba0998bc379ba20505643204 Patch
https://github.com/honojs/node-server/issues/159 Exploit Issue Tracking Third Party Advisory
https://github.com/honojs/node-server/security/advisories/GHSA-hgxw-5xg3-69jx Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:hono:node-server:*:*:*:*:*:node.js:*:*
History

17 Sep 2025, 20:33

Type Values Removed Values Added
References () https://github.com/honojs/node-server/commit/d847e60249fd8183ba0998bc379ba20505643204 - () https://github.com/honojs/node-server/commit/d847e60249fd8183ba0998bc379ba20505643204 - Patch
References () https://github.com/honojs/node-server/issues/159 - () https://github.com/honojs/node-server/issues/159 - Exploit, Issue Tracking, Third Party Advisory
References () https://github.com/honojs/node-server/security/advisories/GHSA-hgxw-5xg3-69jx - () https://github.com/honojs/node-server/security/advisories/GHSA-hgxw-5xg3-69jx - Vendor Advisory
First Time Hono node-server
Hono
CPE cpe:2.3:a:hono:node-server:*:*:*:*:*:node.js:*:*

21 Nov 2024, 09:15

Type Values Removed Values Added
References () https://github.com/honojs/node-server/commit/d847e60249fd8183ba0998bc379ba20505643204 - () https://github.com/honojs/node-server/commit/d847e60249fd8183ba0998bc379ba20505643204 -
References () https://github.com/honojs/node-server/issues/159 - () https://github.com/honojs/node-server/issues/159 -
References () https://github.com/honojs/node-server/security/advisories/GHSA-hgxw-5xg3-69jx - () https://github.com/honojs/node-server/security/advisories/GHSA-hgxw-5xg3-69jx -

22 Apr 2024, 13:28

Type Values Removed Values Added
Summary
  • (es) El adaptador @hono/node-server le permite ejecutar su aplicación Hono en Node.js. Antes de 1.10.1, la aplicación se bloquea cuando recibe un encabezado de Host con un valor que `@hono/node-server` no puede manejar bien. Los valores no válidos son aquellos que la "URL" no puede analizar como un nombre de host, como una cadena vacía, barras diagonales "/" y otras cadenas. La versión 1.10.1 incluye la solución para este problema.

19 Apr 2024, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-19 19:15

Updated : 2025-09-17 20:33

NVD link : CVE-2024-32652

Mitre link : CVE-2024-32652

CVE.ORG link : CVE-2024-32652

JSON object : View

Products Affected

hono

  • node-server
CWE
CWE-755

Improper Handling of Exceptional Conditions