What’s Vulnerable › Vulnerabilities

CVE-2024-43787: Hono CSRF middleware can be bypassed using crafted Content-Type header

• Severity: medium (CVSS 5.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-08-22 · updated 2026-06-17
• Weakness: CWE-352

Description

Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. As a result, attacker can bypass csrf middleware using upper-case form-like MIME type. This vulnerability is fixed in 4.5.8.

Affected products

• honojs hono: before 4.5.8 — fixed in 4.5.8

How to fix

Upgrade to a fixed version: honojs hono 4.5.8. Check the vendor advisory for mitigations.

References

• https://github.com/honojs/hono/blob/b0af71fbcc6dbe44140ea76f16d68dfdb32a99a0/src/middleware/csrf/index.ts#L16-L17
• https://github.com/honojs/hono/commit/41ce840379516410dee60c783142e05bb5a22449
• https://github.com/honojs/hono/security/advisories/GHSA-rpfr-3m35-5vx5

Get alerted when CVE-2024-43787 or the next vulnerability affects your stack