« Volver al listado

CVE-2024-32652

Estado: AnalizadaAlta (7.5)—

The adapter @hono/node-server allows you to run your Hono application on Node.js. Prior to 1.10.1, the application hangs when receiving a Host header with a value that `@hono/node-server` can't handle well. Invalid values are those that cannot be parsed by the `URL` as a hostname such as an empty string, slashes `/`, and other strings. The version 1.10.1 includes the fix for this issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Hono — Node-server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-32652",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-32652",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-04-23T14:58:57.373374Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "honojs",
          "product": "node-server",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.3.0, < 1.10.1"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:hono:node-server:*:*:*:*:*:node.js:*:*"
          ],
          "vendor": "hono",
          "product": "node-server",
          "versions": [
            {
              "status": "affected",
              "version": "1.3.0",
              "lessThan": "1.10.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-04-19T19:15:07.067",
  "references": [
    {
      "url": "https://github.com/honojs/node-server/commit/d847e60249fd8183ba0998bc379ba20505643204",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/honojs/node-server/issues/159",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/honojs/node-server/security/advisories/GHSA-hgxw-5xg3-69jx",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/honojs/node-server/commit/d847e60249fd8183ba0998bc379ba20505643204",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/honojs/node-server/issues/159",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/honojs/node-server/security/advisories/GHSA-hgxw-5xg3-69jx",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-755"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The adapter @hono/node-server allows you to run your Hono application on Node.js. Prior to 1.10.1, the application hangs when receiving a Host header with a value that `@hono/node-server` can't handle well. Invalid values are those that cannot be parsed by the `URL` as a hostname such as an empty string, slashes `/`, and other strings. The version 1.10.1 includes the fix for this issue."
    },
    {
      "lang": "es",
      "value": "El adaptador @hono/node-server le permite ejecutar su aplicación Hono en Node.js. Antes de 1.10.1, la aplicación se bloquea cuando recibe un encabezado de Host con un valor que `@hono/node-server` no puede manejar bien. Los valores no válidos son aquellos que la \"URL\" no puede analizar como un nombre de host, como una cadena vacía, barras diagonales \"/\" y otras cadenas. La versión 1.10.1 incluye la solución para este problema."
    }
  ],
  "lastModified": "2026-06-17T07:30:09.713",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hono:node-server:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C7B1055-D37F-4978-8A0A-A59C056190CF",
              "versionEndExcluding": "1.10.1",
              "versionStartIncluding": "1.3.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}