CVE-2024-32652: 
JavaScript vulnerability analysis and mitigation

The vulnerability CVE-2024-32652 affects @hono/node-server, a Node.js adapter for Hono applications, in versions 1.3.0 to 1.10.1. The vulnerability was discovered and disclosed on April 19, 2024. The issue occurs when the application receives a Host header with values that cannot be properly handled by the server, such as empty strings, slashes, or other invalid hostname strings (GitHub Advisory).

The vulnerability stems from improper handling of exceptional conditions (CWE-755) in the URL parsing mechanism. When receiving a Host header with invalid values that cannot be parsed by the URL constructor as a hostname, the application attempts to create a new URL with the malformed input, resulting in an 'ERR_INVALID_URL' error. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability causes a denial of service condition where the application hangs, making it unavailable to legitimate users. The impact is limited to availability, with no direct effect on confidentiality or integrity of the system (GitHub Advisory).

The vulnerability is easily exploitable over the network and requires no special privileges or user interaction. An attacker can trigger the vulnerability by sending HTTP requests with manipulated Host headers containing invalid values (FortiGuard).

The vulnerability has been fixed in version 1.10.1 of @hono/node-server. However, it is recommended to upgrade to version 1.11.0 or later, which includes additional fixes related to this issue. There are no known workarounds other than upgrading to a patched version (GitHub Advisory).