CVE-2024-48913

MEDIUM

5.9

Description

Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery (CSRF) middleware by a request without Content-Type header. Although the CSRF middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe. This can allow an attacker to bypass CSRF protection implemented with Hono CSRF middleware. Version 4.6.5 fixes this issue.

CVE Details

CVSS v3.1 Score5.9

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N

Attack VectorNETWORK

ComplexityHIGH

Privileges RequiredNONE

User InteractionREQUIRED

Published10/15/2024

Last Modified9/17/2025

Sourcenvd

Honeypot Sightings0

Affected Products

hono:hono

Weaknesses (CWE)

CWE-352

References

https://github.com/honojs/hono/blob/cebf4e87f3984a6a034e60a43f542b4c5225b668/src/middleware/csrf/index.ts#L76-L89(security-advisories@github.com)

https://github.com/honojs/hono/commit/aa50e0ab77b5af8c53c50fe3b271892f8eeeea82(security-advisories@github.com)

https://github.com/honojs/hono/security/advisories/GHSA-2234-fmw7-43wr(security-advisories@github.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.