CVE-2026-56764
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Hono before version 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid credentials through precise timing measurements.
Risk Assessment
An attacker can remotely infer passwords or authentication tokens, leading to unauthorized access to protected resources and potential account takeover.
Recommendation
Upgrade Hono to version 4.11.10 or later immediately, which includes constant-time string comparison in the timingSafeEqual function.
Original NVD description (English source)
Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid credentials through precise timing measurements.