SB2026080392 - Multiple vulnerabilities in hono

Description

This security bulletin contains information about 4 vulnerabilities.

1) Exposure of Data Element to Wrong Session (CVE-ID: N/A)

CWE-ID: CWE-488 - Exposure of Data Element to Wrong Session

CVSSv4: 5.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to exposure of data element to wrong session in the memo() function in hono/jsx when rendering server-side components that read request-specific ambient context through memoized rendering with comparator-equal props. A remote user can trigger rendering of a specially crafted request sequence to disclose sensitive information.

User interaction is required, and exploitation depends on both requests reaching the same warm instance in an order that populates the retained render output.

2) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper handling of connection-scoped response headers in Proxy Helper (hono/proxy) when forwarding proxied origin responses. A remote attacker can cause an application to proxy a response that names additional headers in the Connection header to disclose sensitive information.

Only applications that proxy responses from origins that list custom header names in the Connection response header are affected.

3) Inefficient Algorithmic Complexity (CVE-ID: N/A)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to algorithmic complexity in languageDetector middleware when processing crafted language tags with a large number of hyphen-separated subtags. A remote attacker can send a specially crafted request to cause a denial of service.

Language values may be sourced from a query parameter, cookie, Accept-Language header, or URL path depending on configuration, and the default detector order exposes query-string, cookie, and header-based processing.

4) Inefficient regular expression complexity (CVE-ID: N/A)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in the built-in CORS middleware when processing the Access-Control-Request-Headers header during a CORS preflight request. A remote attacker can send a specially crafted OPTIONS request with a long whitespace sequence in the header value to cause a denial of service.

Only applications using cors() with the default or an empty allowHeaders setting reach the affected code path.

Remediation

Install update from vendor's website.

References

• https://github.com/honojs/hono/security/advisories/GHSA-f23p-vx2j-j53r
• https://github.com/honojs/hono/security/advisories/GHSA-79qm-7rj5-m7r9
• https://github.com/honojs/hono/security/advisories/GHSA-54fx-42gc-7vw4
• https://github.com/honojs/hono/security/advisories/GHSA-8j4g-w8fx-2239