VYPR
← All advisories
Moderate severityNVD Advisory· Published Oct 15, 2024· Updated Nov 7, 2024

Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.

CVE-2024-48913

Description

Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery (CSRF) middleware by a request without Content-Type header. Although the CSRF middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe. This can allow an attacker to bypass CSRF protection implemented with Hono CSRF middleware. Version 4.6.5 fixes this issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
hononpm
< 4.6.54.6.5

Affected products

1

Patches

1
aa50e0ab77b5

Merge commit from fork

https://github.com/honojs/honoYusuke WadaOct 15, 2024via ghsa
commit
2 files changed · +10 −1
  • src/middleware/csrf/index.test.ts+9 −0 modified
    @@ -206,6 +206,15 @@ describe('CSRF by Middleware', () => {
       expect(res.status).toBe(403)
       expect(simplePostHandler).not.toHaveBeenCalled()
     })
+
+    it('should be 403 if the content-type is not set', async () => {
+      const res = await app.request('/form', {
+        method: 'POST',
+        body: new Blob(['test'], {}),
+      })
+      expect(res.status).toBe(403)
+      expect(simplePostHandler).not.toHaveBeenCalled()
+    })
   })
 
   describe('with origin option', () => {
  • src/middleware/csrf/index.ts+1 −1 modified
    @@ -76,7 +76,7 @@ export const csrf = (options?: CSRFOptions): MiddlewareHandler => {
   return async function csrf(c, next) {
     if (
       !isSafeMethodRe.test(c.req.method) &&
-      isRequestedByFormElementRe.test(c.req.header('content-type') || '') &&
+      isRequestedByFormElementRe.test(c.req.header('content-type') || 'text/plain') &&
       !isAllowedOrigin(c.req.header('origin'), c)
     ) {
       const res = new Response('Forbidden', {

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.