CVE-2026-56764
Low · 3.7CVSS
3.7
EPSS
0.3%
Published
Jul 15, 2026
CISA due date
—
The record
Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid credentials through precise timing measurements.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63410 secp256k1-native is a native C secp256k1 implementation for Ruby. CWE-208
- CVE-2026-62860 Picsou is a self-hosted personal finance dashboard. CWE-208
- CVE-2026-93434 An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process… CWE-208
- CVE-2026-65630 Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a… CWE-208
- CVE-2026-87946 Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows… CWE-208
- CVE-2026-49265 OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. CWE-208
- CVE-2026-77696 Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret… CWE-208
- CVE-2026-54875 Issue summary: A non-constant-time optimized implementation of scalar point… CWE-208