Skip to content
Sign in
5.9 Medium

CVE-2024-48913 Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery (CSRF) middleware by…

Description

Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery (CSRF) middleware by a request without Content-Type header. Although the CSRF middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe. This can allow an attacker to bypass CSRF protection implemented with Hono CSRF middleware. Version 4.6.5 fixes this issue.

Affected products and versions

Product Affected versions Fixed in
hono 4.6 earliest → < 4.6.5 4.6.5
Hono 4.6 earliest → < 4.6.5 4.6.5

Other CVEs of hono

The 48 CVEs of hono →
CVE-2026-111757 Hono is a Web application framework that provides support for any JavaScript runtime 5.3 Medium CVE-2026-109955 Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated… 6.9 Medium CVE-2026-93981 hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a… 2.3 Low CVE-2026-84365 Hono is a Web application framework that provides support for any JavaScript runtime 6.5 Medium
Track this CVE