CVE-2026-23744: Hono Node Server Bound To All Interfaces
Hono node server (or equivalent serve() call) is bound to "0.0.0.0", exposing the service on every network interface. Local developer tools that expose privileged endpoints (process spawn, file access, plugin install) must bind to the loopback address ("127.0.0.1") to prevent remote attackers — including drive-by browser requests from malicious sites — from
TSgreprules fetch cve-2026-23744-hono-node-server-bound-to-all-interfaces --engine opengrepDescription
Hono node server (or equivalent serve() call) is bound to "0.0.0.0", exposing the service on every network interface. Local developer tools that expose privileged endpoints (process spawn, file access, plugin install) must bind to the loopback address ("127.0.0.1") to prevent remote attackers — including drive-by browser requests from malicious sites — from
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.