chore(deps): update dependency hono to v4.12.34 [security] #43
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/npm-hono-vulnerability"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
4.12.31→4.12.344.12.27→4.12.34Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
CVE-2026-69207 / GHSA-8j4g-w8fx-2239
More information
Details
Summary
The built-in CORS middleware (
hono/cors) parses the attacker-controlledAccess-Control-Request-Headersrequest header during a preflight (OPTIONS) request using a regular expression whose running time is quadratic in the input length. A single request carrying a long run of whitespace can consume seconds of CPU, and repeated requests can render the service unresponsive. This parsing runs under the default configuration.Details
On a CORS preflight, when
allowHeadersis not configured - the default - the middleware reflects and parses theAccess-Control-Request-Headersvalue. The parser used a whitespace-tolerant regular expression whose backtracking makes the work grow quadratically (O(n²)) with the length of the value when it contains a long whitespace sequence without a delimiter.Because the header value is bounded only by the deployment's maximum HTTP header size, a single preflight can block request processing for a noticeable amount of time; on runtimes that share one execution thread across requests, this stalls concurrent requests as well. No authentication, special origin, or user interaction is required.
This issue arises for any application using
cors()with the default (or an empty)allowHeaders. Applications that set a non-emptyallowHeadersdo not reach the affected path.Impact
An unauthenticated attacker can send preflight requests that each consume disproportionate CPU relative to their size, degrading or denying service. This is a denial-of-service issue only; it does not expose or modify data.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
honojs/hono (hono)
v4.12.34Compare Source
v4.12.33Compare Source
v4.12.32Compare Source
Configuration
📅 Schedule: (in timezone Europe/Berlin)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR has been generated by Mend Renovate.
⚠️ Artifact update problem
Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below:
File name: backend/media_service/pnpm-lock.yaml
File name: backend/image_processing_service/pnpm-lock.yaml
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.