CVE-2026-56764 Hono - Timing Attack in basicAuth and bearerAuth Middleware
Attackers can infer valid credentials via timing attacks in Hono's basicAuth and bearerAuth middlewares due to non-constant-time string comparisons.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-56764?
CVE-2026-56764 is a medium-severity vulnerability in Hono, published on 15 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid credentials through precise timing measurements.
Weakness: CWE-208
Which versions are affected by CVE-2026-56764?
2 open source packages ship an affected version, including hono.
| Package | Affected | Fixed in |
|---|---|---|
hono npm | All versions | 4.11.10 |
hono npm | All versions | 4.11.10 |
How do I fix CVE-2026-56764?
Upgrade hono to 4.11.10 or later.
Is CVE-2026-56764 being exploited?
There is no known exploitation of CVE-2026-56764 in the wild and no public exploit code.
Sources
Also known as GHSA-98q5-3v5r-qvfh, GHSA-gq3j-xvxp-8hrf, MINI-8jw2-hw2p-75jv, MINI-cr23-mgwf-wr67, MINI-xq72-r823-549r.