CVE-2024-23340
1 advisory.
npm/@hono/node-server CVE-2024-23340: medium 5.3, EPSS 0.72%
@hono/node-server cannot handle "double dots" in URL
Action: Upgrade @hono/node-server to 1.4.1 or later.
npm i @hono/node-server@1.4.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.3.0 | 1.4.1 | - |
Fixed versions
| 1.4.1 |
Sources
- osv: GHSA-rjq5-w47x-x359
- https://github.com/honojs/node-server/security/advisories/GHSA-rjq5-w47x-x359
- https://nvd.nist.gov/vuln/detail/CVE-2024-23340
- https://github.com/honojs/node-server/commit/dd9b9a9b23e3896403c90a740e7f1f0892feb402
- https://github.com/honojs/node-server
- https://github.com/honojs/node-server/blob/8cea466fd05e6d2e99c28011fc0e2c2d3f3397c9/src/request.ts#L43-L45
CVE-2024-23340 · published · modified · JSON