Named path parameters can be overridden in TrieRouter
Impact
The clients may override named path parameter values from previous requests if the application is using TrieRouter. So, there is a risk that a privileged user may use unintended parameters when deleting REST API resources.
TrieRouter is used either explicitly or when the application matches a pattern that is not supported by the default RegExpRouter.
The code to reproduce it. The server side application:
import { Hono } from 'hono'
import { TrieRouter } from 'hono/router/trie-router'
const wait = async (ms: number) => {
return new Promise((resolve) => {
setTimeout(resolve, ms)
})
}
const app = new Hono({ router: new TrieRouter() })
app.use('*', async (c, next) => {
await wait(Math.random() * 200)
return next()
})
app.get('/modules/:id/versions/:version', async (c) => {
const id = c.req.param('id')
const version = c.req.param('version')
console.log('path', c.req.path)
console.log('version', version)
return c.json({
id,
version,
})
})
export default app
The client code which makes requests to the server application:
const examples = [
'http://localhost:8787/modules/first/versions/first',
'http://localhost:8787/modules/second/versions/second',
'http://localhost:8787/modules/third/versions/third',
]
const test = () => {
for (const example of examples) {
fetch(example)
.then((response) => response.json())
.then((data) => {
const splitted = example.split('/')
const expected = splitted[splitted.length - 1]
if (expected !== data.version) {
console.error(`Error: exprected ${expected} but got ${data.version} - url was ${example}`)
}
})
}
}
test()
The results:
Error: exprected second but got third - url was http://localhost:8787/modules/second/versions/second
Error: exprected first but got third - url was http://localhost:8787/modules/first/versions/first
Patches
"v3.11.7" includes the change to fix this issue.
Workarounds
Don't use TrieRouter directly.
// DON'T USE TrieRouter
import { TrieRouter } from 'hono/router/trie-router'
const app = new Hono({ router: new TrieRouter() })
References
Router options on the Hono website: https://hono.dev/api/hono#router-option
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | hono | < 3.11.7 | 3.11.7 |
Referencias
- Vector CVSS
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L- Debilidad (CWE)
CWE-94- Plataforma
- npm
- Paquete
hono- Publicada
- 15.12.2023
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-f6gv-hh8j-q8vq - CC BY 4.0
Historial de vulnerabilidades: hono
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 52
- Primera → última
- 12.2023 10.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 7
- Media 41
- Baja 4
Divulgaciones por año
- 2023: 1
- 2024: 3
- 2025: 4
- 2026: 44
-
Named path parameters can be overridden in TrieRouter esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.