EUVD-2026-44631
GHSA-98q5-3v5r-qvfh
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable timing oracle requires low-jitter conditions for reliable exploitation (AC:H); no privileges needed to send auth probes (PR:N); impact limited to potential credential inference with no integrity or availability consequence.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3Blast Radius
ecosystem impact- 21 npm packages depend on hono (21 direct, 0 indirect)
Ecosystem-wide dependent count for version 4.11.10.
DescriptionCVE.org
Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid credentials through precise timing measurements.
AnalysisAI
Credential inference via timing side-channel is possible in Hono before 4.11.10 when the built-in basicAuth or bearerAuth middlewares are in use, due to JavaScript's short-circuit = string equality operator being used inside the timingSafeEqual function for hash comparison. Because = terminates on the first differing character, response times vary slightly based on how many leading characters of a credential match the stored hash, enabling an attacker to recover credentials one character at a time through statistical timing analysis. No public exploit has been identified and the vendor GHSA advisory explicitly characterizes this as a hardening improvement with low practical exploitability outside highly controlled, low-jitter network environments.
Technical ContextAI
Hono is a lightweight, edge-native web framework for JavaScript and TypeScript distributed via npm (hono), designed to run across runtimes including Cloudflare Workers, Deno, Bun, and Node.js. The affected component is the internal timingSafeEqual utility function used by both the basicAuth and bearerAuth built-in middleware modules to compare a supplied credential against the expected hash. CWE-208 (Observable Timing Discrepancy) describes exactly this root cause: when a secret comparison leaks execution time as a side channel, an attacker can iteratively probe character positions to reconstruct the secret. In standard JavaScript, the === operator is a lexicographic comparison that short-circuits as soon as a byte mismatch is found, meaning a credential that matches the first N characters takes measurably longer to reject than one that diverges immediately. The fix in commit 91def7cab654bad5eecc9270e6620d577971ff5e replaces this with a byte-by-byte constant-time comparison to eliminate the differential signal. The CPE cpe:2.3:a:hono:hono:*:*:*:*:*:*:*:* covers all versions of the package prior to 4.11.10.
RemediationAI
Upgrade the hono npm package to version 4.11.10 or later; this is the vendor-released patch per the GHSA advisory at https://github.com/honojs/hono/security/advisories/GHSA-gq3j-xvxp-8hrf, with the fix implemented in commit 91def7cab654bad5eecc9270e6620d577971ff5e. If an immediate upgrade is not feasible, two compensating controls can raise the bar for exploitation: first, enforce aggressive rate limiting on authentication endpoints (e.g., 5-10 requests per IP per minute) to dramatically increase the time required to accumulate statistically significant timing samples - the trade-off is legitimate clients may be throttled during burst usage; second, introduce a fixed artificial delay (e.g., await sleep(Math.random() * 5) ms) in authentication response paths to add jitter that masks the underlying timing signal - the trade-off is increased average authentication latency. Neither workaround eliminates the root cause and both should be treated as temporary measures pending the upgrade.
The adapter @hono/node-server allows you to run your Hono application on Node.js. Rated high severity (CVSS 7.5), this v
Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery (CSRF) middleware by
Quadratic-complexity denial of service in Hono's `languageDetector` middleware (versions 4.12.0-4.12.33) allows unauthen
Hono is a Web application framework that provides support for any JavaScript runtime. Rated medium severity (CVSS 5.3),
@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Rated medium severity (CVSS 5.3),
Hono is a Web application framework that provides support for any JavaScript runtime. Rated medium severity (CVSS 5.0),
Cross-user HTML disclosure in Hono's server-side rendering affects all applications using hono/jsx with memo()-wrapped c
Hono is a web framework written in TypeScript. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploita
Hono is a Web application framework that provides support for any JavaScript runtime. [CVSS 8.2 HIGH]
Hono versions before 4.11.4 allow JWT algorithm confusion attacks through improper algorithm validation in the JWK/JWKS
Hono before version 4.11.4 contains a JWT algorithm confusion vulnerability in its JWK/JWKS verification middleware that
Hono's `proxy()` function in the `hono/proxy` Proxy Helper leaks connection-scoped response headers to downstream client
Same weakness CWE-208 – Observable Timing Discrepancy
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today