CVE-2024-43787

Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. As a result, attacker can bypass csrf middleware using upper-case form-like MIME type. This vulnerability is fixed in 4.5.8.

• CWE-352

• https://github.com/honojs/hono/blob/b0af71fbcc6dbe44140ea76f16d68dfdb32a99a0/src/middleware/csrf/index.ts#L16-L17Product
• https://github.com/honojs/hono/commit/41ce840379516410dee60c783142e05bb5a22449Patch
• https://github.com/honojs/hono/security/advisories/GHSA-rpfr-3m35-5vx5Exploit, Vendor Advisory

Published

Aug 22, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-43780Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, …4.3
• CVE-2024-43781A vulnerability has been identified in SINUMERIK 828D V4 (Al…6.8
• CVE-2024-43782This openedx-translations repository contains translation fi…9.8
• CVE-2024-43783The Apollo Router Core is a configurable, high-performance g…7.5
• CVE-2024-43784lakeFS is an open-source tool that transforms object storage…5.7
• CVE-2024-43785gitoxide An idiomatic, lean, fast & safe pure Rust implement…2.5
• CVE-2024-43788Webpack is a module bundler. Its main purpose is to bundle J…6.1
• CVE-2024-43789Discourse is an open source platform for community discussio…4.3
• CVE-2024-4379The Premium Addons for Elementor plugin for WordPress is vul…5.4
• CVE-2024-43790Vim is an open source command line text editor. When perform…5.5
• CVE-2024-43791RequestStore provides per-request global storage for Rack. T…7.8
• CVE-2024-43792Halo is an open source website building tool. A security vul…6.1