Is CVE-2026-56764 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56764 being exploited in the wild.

How severe is CVE-2026-56764?

Low severity, with a CVSS score of 3.7, published 15 July 2026.

Which products and versions are affected?

hono (npm) SEMVER:introduced=0,fixed=4.11.10.

Is there a fix for CVE-2026-56764?

Yes. hono (npm): upgrade to 4.11.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56764 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56764?

Check whether you run hono (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56764: Hono timing attack in basicAuth and bearerAuth middlewares

CVE-2026-56764 · Severity: low · CVSS 3.7 · Published 2026-07-15

Hono, a popular web framework, contained a flaw in how it verified user credentials. Because the system stopped checking a password as soon as it found a wrong character, an attacker could theoretically measure these tiny differences in response time to guess valid login information. While difficult to execute in practice, this could lead to unauthorized access to protected parts of an application.

Technologies: hono (npm). Vendors: npm.

Quick answers

Is CVE-2026-56764 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56764 being exploited in the wild.
How severe is CVE-2026-56764?: Low severity, with a CVSS score of 3.7, published 15 July 2026.
Which products and versions are affected?: hono (npm) SEMVER:introduced=0,fixed=4.11.10.
Is there a fix for CVE-2026-56764?: Yes. hono (npm): upgrade to 4.11.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56764 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56764?: Check whether you run hono (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

hono (npm): upgrade to 4.11.10 or later
```
npm install hono@4.11.10
```

Technical details

A timing discrepancy vulnerability (CWE-208) exists in Hono's basicAuth and bearerAuth middlewares prior to version 4.11.10. The root cause is the use of standard JavaScript strict equality (===) within the timingSafeEqual function when comparing hash values. Because JavaScript string comparisons terminate early upon encountering a mismatched character, an attacker can perform high-precision timing analysis over a network to bit-flip or character-guess valid credentials. This is a high-complexity attack requiring a stable network environment to measure micro-fluctuations in response times. The issue was mitigated in version 4.11.10 by implementing a constant-time comparison method that avoids early termination.

Affected products

Hono Hono < 4.11.10

Identifiers

CVE-2026-56764
GHSA-gq3j-xvxp-8hrf

Timeline

2026-02-18: advisory: GitHub Security Advisory published
2026-07-15: disclosed: NVD publication date
2026-07-15: patched: Fix confirmed in version 4.11.10

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.