CVE-2026-56764

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.11.10

Description The basicAuth and bearerAuth middlewares are susceptible to a timing attack. This occurs because the timingSafeEqual() function performs non-constant-time string comparisons, meaning the process terminates early when a mismatch is found. An attacker can use precise timing measurements of these responses to infer valid credentials.

Recommendations Update to version 4.11.10 or later.