CVE-2024-32652CWE-755

@hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed

High · published April 19, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
58.8
In the wild
Unconfirmed
What it is

The adapter @hono/node-server allows you to run your Hono application on Node.js. Prior to 1.10.1, the application hangs when receiving a Host header with a value that `@hono/node-server` can't handle well. Invalid values are those that cannot be parsed by the `URL` as a hostname such as an empty string, slashes `/`, and other strings. The version 1.10.1 includes the fix for this issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00882 · 58.8th percentile
Weakness
CWE-755 · Improper Handling of Exceptional Conditions
Published
2024-04-19T18:29Z
EPSS history
Timeline
  • 19 APR 18:29Z
    @hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed
    cvelistv5