CVE-2023-50710 Hono's named path parameters can be overridden in TrieRouter

What is CVE-2023-50710?

CVE-2023-50710 is a medium-severity vulnerability in honojs hono, published on 14 Dec 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Hono is a web framework written in TypeScript. Prior to version 3.11.7, clients may override named path parameter values from previous requests if the application is using TrieRouter. So, there is a risk that a privileged user may use unintended parameters when deleting REST API resources. TrieRouter is used either explicitly or when the application matches a pattern that is not supported by the default RegExpRouter. Version 3.11.7 includes the change to fix this issue. As a workaround, avoid using TrieRouter directly.

Weakness: CWE-94

Which versions are affected by CVE-2023-50710?

2 open source packages ship an affected version, including hono. It affects 1 product.

Products include Hono Hono.

How do I fix CVE-2023-50710?

Upgrade hono to 3.11.7 or later.

Is CVE-2023-50710 being exploited?

There is no known exploitation of CVE-2023-50710 in the wild and no public exploit code.

Other vulnerabilities in honojs hono

• CVE-2026-27700 Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo High 8.2
• CVE-2026-22817 JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass High 8.2
• CVE-2026-22818 JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback) High 8.2
• CVE-2025-62610 Hono Improperly Authorizes JWT Audience Validation High 8.1
• CVE-2026-29045 Hono: Arbitrary file access via serveStatic vulnerability High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f6gv-hh8j-q8vq.