-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| hono | npm | < 4.5.8 | 4.5.8 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the case-sensitive regex pattern in the CSRF middleware's Content-Type validation. The key evidence is: 1) The original regex (/application\/x-www-form-urlencoded/) lacked the 'i' flag 2) The fix added case-insensitivity via /i modifier 3) The PoC demonstrates exploitation using uppercase 'Application/x-www-form-urlencoded' 4) The test case added in the commit specifically checks this bypass scenario. The middleware's security logic relied on this regex to trigger CSRF validation, making the regex implementation the root vulnerable component.
JavaScriptJavaScriptOngoing coverage of React2Shell