Is CVE-2024-32652 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-32652 being exploited in the wild.

How severe is CVE-2024-32652?

Low severity, with a CVSS score of 3.1, published 19 April 2024.

Which products and versions are affected?

@hono/node-server (npm) SEMVER:introduced=1.3.0,fixed=1.10.1.

Is there a fix for CVE-2024-32652?

Yes. @hono/node-server (npm): upgrade to 1.10.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-32652 attacked?

It is attacked over the network.

Am I affected by CVE-2024-32652?

Check whether you run @hono/node-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-32652: @hono/node-server denial of service in Host header parsing

CVE-2024-32652 · Severity: low · CVSS 3.1 · Published 2024-04-19

@hono/node-server is a Node.js server adapter for the Hono web framework. When the server receives an HTTP request with an unparseable Host header (such as an empty value or invalid characters), the application crashes and becomes unavailable. An attacker can trigger this with a single malformed request, causing service disruption.

Technologies: @hono/node-server (npm). Vendors: npm.

Quick answers

Is CVE-2024-32652 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-32652 being exploited in the wild.
How severe is CVE-2024-32652?: Low severity, with a CVSS score of 3.1, published 19 April 2024.
Which products and versions are affected?: @hono/node-server (npm) SEMVER:introduced=1.3.0,fixed=1.10.1.
Is there a fix for CVE-2024-32652?: Yes. @hono/node-server (npm): upgrade to 1.10.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-32652 attacked?: It is attacked over the network.
Am I affected by CVE-2024-32652?: Check whether you run @hono/node-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@hono/node-server (npm): upgrade to 1.10.1 or later
```
npm install @hono/node-server@1.10.1
```

Technical details

The vulnerability is an improper error handling issue (CWE-755) in URL parsing logic. When @hono/node-server processes an incoming HTTP request, it attempts to parse the Host header using Node.js's URL constructor without proper validation or exception handling. If the Host header contains values that cannot be parsed as valid hostnames (e.g., empty string, slashes, or other invalid formats), the URL constructor throws a TypeError with code 'ERR_INVALID_URL', which is not caught, causing the application to crash. Attack vector is network-based, requires no authentication or user interaction, and can be triggered by any HTTP client capable of sending custom headers. The fix was implemented in version 1.10.1 and further improved in 1.11.0.

Affected products

Hono @hono/node-server >=1.3.0, <1.10.1

Identifiers

CVE-2024-32652
GHSA-hgxw-5xg3-69jx

Timeline

2024-04-19: disclosed
2024-04-19: patched: Version 1.10.1 released with fix; version 1.11.0 recommended for additional related fixes

References

https://github.com/honojs/node-server/security/advisories/GHSA-hgxw-5xg3-69jx

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.