Executive brief
@hono/node-server is a Node.js server adapter for the Hono web framework. When the server receives an HTTP request with an unparseable Host header (such as an empty value or invalid characters), the application crashes and becomes unavailable. An attacker can trigger this with a single malformed request, causing service disruption.
Technical details
The vulnerability is an improper error handling issue (CWE-755) in URL parsing logic. When @hono/node-server processes an incoming HTTP request, it attempts to parse the Host header using Node.js's URL constructor without proper validation or exception handling. If the Host header contains values that cannot be parsed as valid hostnames (e.g., empty string, slashes, or other invalid formats), the URL constructor throws a TypeError with code 'ERR_INVALID_URL', which is not caught, causing the application to crash. Attack vector is network-based, requires no authentication or user interaction, and can be triggered by any HTTP client capable of sending custom headers. The fix was implemented in version 1.10.1 and further improved in 1.11.0.
Affected products
- Hono @hono/node-server >=1.3.0, <1.10.1
Timeline
- 2024-04-19: disclosed
- 2024-04-19: patched: Version 1.10.1 released with fix; version 1.11.0 recommended for additional related fixes