Skip to content
Sign in
5.0 Medium

CVE-2024-43787 Hono is a Web application framework that provides support for any JavaScript runtime

Description

Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. As a result, attacker can bypass csrf middleware using upper-case form-like MIME type. This vulnerability is fixed in 4.5.8.

Affected products and versions

Product Affected versions Fixed in
hono 4.5 earliest → < 4.5.8 4.5.8
hono 4.5 earliest → < 4.5.8 4.5.8

Other CVEs of hono

The 48 CVEs of hono →
CVE-2026-111757 Hono is a Web application framework that provides support for any JavaScript runtime 5.3 Medium CVE-2026-109955 Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated… 6.9 Medium CVE-2026-93981 hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a… 2.3 Low CVE-2026-84365 Hono is a Web application framework that provides support for any JavaScript runtime 6.5 Medium
Track this CVE