CVE-2023-50710 - CVE House

Back to Database

Status published Medium CVE-2023-50710

Hono's named path parameters can be overridden in TrieRouter

4.2 CVSS

Vulnerability Description

Hono is a web framework written in TypeScript. Prior to version 3.11.7, clients may override named path parameter values from previous requests if the application is using TrieRouter. So, there is a risk that a privileged user may use unintended parameters when deleting REST API resources. TrieRouter is used either explicitly or when the application matches a pattern that is not supported by the default RegExpRouter. Version 3.11.7 includes the change to fix this issue. As a workaround, avoid using TrieRouter directly.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-50710

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from honojs

View All →

Hono Improperly Authorizes JWT Audience Validation

Hono has Body Limit Middleware Bypass

Hono contains a flaw in URL path parsing, potentially leading to path confusion

Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.

Hono CSRF middleware can be bypassed using crafted Content-Type header

Affected Vendor

honojs

View all reports →

Affected Software

hono

Vulnerable Versions:

< 3.11.7

Timeline

Official Publish: December 14th, 2023

Last Modified: August 2nd, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1565.002 Stored Data Manipulation