CVE-2024-32652

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The adapter @hono/node-server allows you to run your Hono application on Node.js. Prior to 1.10.1, the application hangs when receiving a Host header with a value that `@hono/node-server` can't handle well. Invalid values are those that cannot be parsed by the `URL` as a hostname such as an empty string, slashes `/`, and other strings. The version 1.10.1 includes the fix for this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-755

Affected software

Vendor	Product	Versions
honojs	node-server	>= 1.3.0, < 1.10.1
hono	node-server	>= 1.3.0, < 1.10.1

References

https://github.com/honojs/node-server/commit/d847e60249fd8183ba0998bc379ba20505643204Patch
https://github.com/honojs/node-server/issues/159Exploit, Issue Tracking, Third Party Advisory
https://github.com/honojs/node-server/security/advisories/GHSA-hgxw-5xg3-69jxVendor Advisory
https://github.com/honojs/node-server/commit/d847e60249fd8183ba0998bc379ba20505643204Patch
https://github.com/honojs/node-server/issues/159Exploit, Issue Tracking, Third Party Advisory
https://github.com/honojs/node-server/security/advisories/GHSA-hgxw-5xg3-69jxVendor Advisory

Timeline

Published: Apr 19, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-326536.1jadx is a Dex to Java decompiler. Prior to version 1.5.0, the package name is not filtered before concatenation. This can be exploited to CVE-2024-326558.1Npgsql is the .NET data provider for PostgreSQL. The `WriteBind()` method in `src/Npgsql/Internal/NpgsqlConnector.FrontendMessages.cs` uses CVE-2024-326567.8Ant Media Server is live streaming engine software. A local privilege escalation vulnerability in present in versions 2.6.0 through 2.8.2 al CVE-2024-326575.4Hydra is a Continuous Integration service for Nix based projects. Attackers can execute arbitrary code in the browser context of Hydra and e CVE-2024-326589.8FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bound CVE-2024-326599.8FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bound CVE-2024-32665.4The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of widgets in all versions up CVE-2024-326607.5FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious server can crash the FreeRDP client by CVE-2024-326617.5FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to a possible `CVE-2024-326629.8FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bound CVE-2024-326637.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0 CVE-2024-326647.3Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0