hono vulnerabilities (npm)
53 vulnerabilities.
-
hononpm Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths 5.3 Medium -
hononpm Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding 6.9 Medium -
hononpm hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings 2.3 Low -
hononpm Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory 6.5 Medium -
hononpm Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion 5.3 Medium -
hononpm Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials 5.9 Medium -
hononpm Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure 4.8 Medium -
hononpm Hono: Proxy Helper does not remove response headers listed in the `Connection` header 3.7 Low -
hononpm Hono: Algorithmic Complexity DoS in Language Middleware 5.3 Medium -
hononpm Hono: ReDoS in CORS middleware via Access-Control-Request-Headers 5.3 Medium -
hononpm Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility 6.1 Medium -
hononpm hono/jsx does not isolate context per request, leading to cross-request data disclosure 6.5 Medium -
hononpm Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication 4.8 Medium -
hononpm Hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length` 6.5 Medium -
hononpm Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest 4.8 Medium -
hononpm Hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard 7.1 High -
hononpm Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) 5.9 Medium -
hononpm Hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice 5.3 Medium -
hononpm Hono: JWT middleware accepts any Authorization scheme, not only Bearer 4.8 Medium -
hononpm Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 5.3 Medium -
hononpm Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection 4.3 Medium -
hononpm Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths 5.3 Medium -
hononpm Hono: CSS Declaration Injection via Style Object Values in JSX SSR 4.3 Medium -
hononpm Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify() 3.8 Low -
hononpm Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage 5.3 Medium -
hononpm Hono: bodyLimit() can be bypassed for chunked / unknown-length requests 6.5 Medium -
hononpm Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection 4.7 Medium -
hononpm hono - HTML Injection via Improper JSX Attribute Name Handling in SSR 5.3 Medium -
hononpm Hono has a non-breaking space prefix bypass in cookie name handling in getCookie() 4.8 Medium -
hononpm Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses 6.3 Medium -
hononpm Hono - Missing Cookie Name Validation in setCookie() 6.9 Medium -
hononpm Hono has a path traversal in toSSG() allows writing files outside the output directory 5.9 Medium -
hononpm Hono has a middleware bypass via repeated slashes in serveStatic 5.3 Medium -
hononpm Hono - Prototype Pollution via __proto__ Key in parseBody with dot Option 6.3 Medium -
hononpm Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie() 5.4 Medium -
hononpm Hono: SSE Control Field Injection via CR/LF in writeSSE() 6.5 Medium -
hononpm Hono: Arbitrary file access via serveStatic vulnerability 7.5 High -
hononpm Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo 8.2 High -
hononpm Hono - Timing Attack in basicAuth and bearerAuth Middleware 6.3 Medium -
hononpm Hono has a Cross-site Scripting vulnerability 4.7 Medium -
hononpm Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter) 6.3 Medium -
hononpm Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception 5.3 Medium -
hononpm Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing 4.8 Medium -
hononpm JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass 8.2 High -
hononpm JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback) 8.2 High -
hononpm Hono - Vary Header Injection in CORS Middleware 6.9 Medium -
hononpm Hono Improperly Authorizes JWT Audience Validation 8.1 High -
hononpm Hono has Body Limit Middleware Bypass 5.3 Medium -
hononpm Hono contains a flaw in URL path parsing, potentially leading to path confusion 7.5 High -
hononpm Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header. 5.9 Medium - Show olderLoading…