@rootio/hono vulnerabilities (Root)
21 vulnerabilities.
-
@rootio/honoRoot Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility 6.1 Medium -
@rootio/honoRoot Hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length` 6.5 Medium -
@rootio/honoRoot Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest 4.8 Medium -
@rootio/honoRoot Hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard 7.1 High -
@rootio/honoRoot Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) 5.9 Medium -
@rootio/honoRoot Hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice 5.3 Medium -
@rootio/honoRoot Hono: JWT middleware accepts any Authorization scheme, not only Bearer 4.8 Medium -
@rootio/honoRoot Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 5.3 Medium -
@rootio/honoRoot Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection 4.3 Medium -
@rootio/honoRoot Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths 5.3 Medium -
@rootio/honoRoot Hono: CSS Declaration Injection via Style Object Values in JSX SSR 4.3 Medium -
@rootio/honoRoot Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage 5.3 Medium -
@rootio/honoRoot Hono: bodyLimit() can be bypassed for chunked / unknown-length requests 6.5 Medium -
@rootio/honoRoot Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection 4.7 Medium -
@rootio/honoRoot hono - HTML Injection via Improper JSX Attribute Name Handling in SSR 5.3 Medium -
@rootio/honoRoot Hono has a non-breaking space prefix bypass in cookie name handling in getCookie() 4.8 Medium -
@rootio/honoRoot Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses 6.3 Medium -
@rootio/honoRoot Hono has a middleware bypass via repeated slashes in serveStatic 5.3 Medium -
@rootio/honoRoot Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie() 5.4 Medium -
@rootio/honoRoot Hono: SSE Control Field Injection via CR/LF in writeSSE() 6.5 Medium -
@rootio/honoRoot Hono: Arbitrary file access via serveStatic vulnerability 7.5 High