CVE-2024-43787

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. As a result, attacker can bypass csrf middleware using upper-case form-like MIME type. This vulnerability is fixed in 4.5.8.

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Aug 22, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-437886.1Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, CVE-2024-437894.3Discourse is an open source platform for community discussion. A user can create a post with many replies, and then attempt to fetch them al CVE-2024-43795.4The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Global Tooltip widget in CVE-2024-437905.5Vim is an open source command line text editor. When performing a search and displaying the search-count message is disabled (:set shm+=S), CVE-2024-437917.8RequestStore provides per-request global storage for Rack. The files published as part of request_store 1.3.2 have 0666 permissions, meaning CVE-2024-437926.1Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project. CVE-2024-437936.4Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.19.0 of the Halo project. CVE-2024-437946.1OpenSearch Dashboards Security Plugin adds a configuration management UI for the OpenSearch Security features to OpenSearch Dashboards. Impr CVE-2024-437956.1OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. The login functional CVE-2024-437964.7Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.red CVE-2024-437974.3audiobookshelf is a self-hosted audiobook and podcast server. A non-admin user is not allowed to create libraries (or access only the ones t CVE-2024-437988.6Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn't ever read the documented `AUTH` environme