{"id":"CVE-2026-56764","aliases":["CLSA-2026-1790413170","EUVD-2026-44631","GHSA-98q5-3v5r-qvfh","GHSA-gq3j-xvxp-8hrf","RHSA-2026:47618","RHSA-2026:47619"],"status":"published","title":"Hono - Timing Attack in basicAuth and bearerAuth Middleware","description":"Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid credentials through precise timing measurements.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00297,"percentile":0.22575,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-208"],"published":"2026-02-19T20:15:59Z","modified":"2026-10-28T02:30:37Z","fixes":[{"ecosystem":"npm","package":"hono","fixed_in":["4.11.10"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"hono","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.10"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"hono","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.12-tuxcare.0"},{"fixed":"3.12.12-tuxcare.1"}]}],"versions":["3.12.12"],"bundled":14},{"source":"osv","ecosystem":"npm","package":"hono","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.11.10"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.1-0.2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.6-0.2.hum1"}]}],"bundled":6}],"products":[{"vendor":"hono","product":"hono"},{"vendor":"honojs","product":"hono"}],"references":[{"url":"https://github.com/honojs/hono/security/advisories/GHSA-gq3j-xvxp-8hrf","tags":["vendor-advisory","advisory","web","article"]},{"url":"https://www.vulncheck.com/advisories/hono-timing-attack-in-basicauth-and-bearerauth-middleware","tags":["third-party-advisory","advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56764","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-98q5-3v5r-qvfh"},{"url":"https://github.com/honojs/hono/commit/91def7cab654bad5eecc9270e6620d577971ff5e","tags":["web"]},{"url":"https://github.com/honojs/hono/releases/tag/v4.11.10","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gq3j-xvxp-8hrf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56764.json","tags":["advisory"]},{"url":"https://github.com/honojs/hono","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47618","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56764","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42127","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47618.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491449","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42127","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42127","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-42127","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500893","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56764","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47619","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67213","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67321","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67312","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67320","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47619.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508406","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67213","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67213","tags":["advisory"]},{"url":"https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/5.1.6","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510007","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67312","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67312","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formtojson","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509993","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67320","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67320","tags":["advisory"]},{"url":"https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc","tags":["article"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510011","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67321","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67321","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2026-56764","title":"Hono - Timing Attack in basicAuth and bearerAuth Middleware","description":"Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid credentials through precise timing measurements.","status":"published","published":"2026-07-15T11:25:32.814Z","modified":"2026-07-15T13:50:24.7Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T13:36:51.6229Z"}],"euvd":[{"id":"EUVD-2026-44631","description":"Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid credentials through precise timing measurements.","status":"published","published":"2026-07-15T11:25:32Z","modified":"2026-07-15T13:50:24Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:19:53.226345Z"}],"ghsa":[{"id":"GHSA-98q5-3v5r-qvfh","title":"Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth...","description":"Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid credentials through precise timing measurements.","status":"published","published":"2026-07-15T12:32:02Z","modified":"2026-07-15T12:32:03Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T15:09:32.601666Z"},{"id":"GHSA-gq3j-xvxp-8hrf","title":"Hono added timing comparison hardening in basicAuth and bearerAuth","description":"## Summary\n\nThe `basicAuth` and `bearerAuth` middlewares previously used a comparison that was not fully timing-safe.\n\nThe `timingSafeEqual` function used normal string equality (`===`) when comparing hash values. This comparison may stop early if values differ, which can theoretically cause small timing differences.\n\nThe implementation has been updated to use a safer comparison method.\n\n\n## Details\n\nThe issue was caused by the use of normal string equality (`===`) when comparing hash values inside the `timingSafeEqual` function.\n\nIn JavaScript, string comparison may stop as soon as a difference is found. This means the comparison time can slightly vary depending on how many characters match.\n\nUnder very specific and controlled conditions, this behavior could theoretically allow timing-based analysis.\n\nThe implementation has been updated to:\n\n- Avoid early termination during comparison\n- Use a constant-time-style comparison method\n\n## Impact\n\nThis issue is unlikely to be exploited in normal environments.\n\nIt may only be relevant in highly controlled situations where precise timing measurements are possible.\n\nThis change is considered a security hardening improvement. Users are encouraged to upgrade to the latest version.","status":"published","published":"2026-02-19T20:15:59Z","modified":"2026-02-19T20:16:02Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:39:25.82905Z"}],"nvd":[{"id":"CVE-2026-56764","description":"Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid credentials through precise timing measurements.","status":"published","published":"2026-07-15T12:18:15.44Z","modified":"2026-10-24T22:10:00.21Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:12:29.879716Z"}],"osv":[{"id":"CVE-2026-56764","title":"Hono - Timing Attack in basicAuth and bearerAuth Middleware","description":"Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid credentials through precise timing measurements.","status":"published","published":"2026-07-15T11:25:32.814Z","modified":"2026-10-28T02:30:37.211145656Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T15:45:11.609219Z"},{"id":"GHSA-gq3j-xvxp-8hrf","title":"Hono added timing comparison hardening in basicAuth and bearerAuth","description":"## Summary\n\nThe `basicAuth` and `bearerAuth` middlewares previously used a comparison that was not fully timing-safe.\n\nThe `timingSafeEqual` function used normal string equality (`===`) when comparing hash values. This comparison may stop early if values differ, which can theoretically cause small timing differences.\n\nThe implementation has been updated to use a safer comparison method.\n\n\n## Details\n\nThe issue was caused by the use of normal string equality (`===`) when comparing hash values inside the `timingSafeEqual` function.\n\nIn JavaScript, string comparison may stop as soon as a difference is found. This means the comparison time can slightly vary depending on how many characters match.\n\nUnder very specific and controlled conditions, this behavior could theoretically allow timing-based analysis.\n\nThe implementation has been updated to:\n\n- Avoid early termination during comparison\n- Use a constant-time-style comparison method\n\n## Impact\n\nThis issue is unlikely to be exploited in normal environments.\n\nIt may only be relevant in highly controlled situations where precise timing measurements are possible.\n\nThis change is considered a security hardening improvement. Users are encouraged to upgrade to the latest version.","status":"published","published":"2026-02-19T20:15:59Z","modified":"2026-09-10T03:50:35.112615157Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"RHSA-2026:47618","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-30T10:17:39Z","modified":"2026-10-07T10:12:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:47619","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-30T10:17:39Z","modified":"2026-10-20T10:09:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"CLSA-2026-1790413170","title":"TuxCare security update for hono (15 CVEs)","description":"TuxCare rebuilt hono to address 15 CVEs. Fixed in 3.12.12-tuxcare.1.","status":"published","published":"2026-09-26T08:59:30Z","modified":"2026-10-15T09:47:56.5204861Z","updated_at":"2026-11-02T15:43:48.65893Z"}]}}