Hono vulnerabilities

Products

• Hono 38
• Node-server 4

Newest

• hono Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility CVE-2026-59895 Fix available 6.1 MediumJuly 8, 2026
• hono hono/jsx does not isolate context per request, leading to cross-request data disclosure CVE-2026-59896 Fix available 6.5 MediumJuly 8, 2026
• hono Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication CVE-2026-59897 Fix available 4.8 MediumJuly 8, 2026
• hono Hono: JWT middleware accepts any Authorization scheme, not only Bearer CVE-2026-47673 Fix available 4.8 MediumMay 28, 2026
• hono Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 CVE-2026-47674 Fix available 5.3 MediumMay 28, 2026
• hono Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection CVE-2026-47675 Fix available 4.3 MediumMay 28, 2026
• hono Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths CVE-2026-47676 Fix available 5.3 MediumMay 28, 2026
• hono Hono: CSS Declaration Injection via Style Object Values in JSX SSR CVE-2026-44458 Fix available 4.3 MediumMay 9, 2026
• hono Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify() CVE-2026-44459 Fix available 3.8 LowMay 9, 2026
• hono Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage CVE-2026-44457 Fix available 5.3 MediumMay 9, 2026
• hono Hono: bodyLimit() can be bypassed for chunked / unknown-length requests CVE-2026-44456 Fix available 6.5 MediumMay 6, 2026
• hono Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection CVE-2026-44455 Fix available 4.7 MediumMay 6, 2026
• hono hono - HTML Injection via Improper JSX Attribute Name Handling in SSR CVE-2026-56761 Fix available 5.3 MediumApril 16, 2026
• hono Hono has a non-breaking space prefix bypass in cookie name handling in getCookie() CVE-2026-39410 Fix available 4.8 MediumApril 8, 2026
• hono Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses CVE-2026-39409 Fix available 6.3 MediumApril 8, 2026
• hono Hono - Missing Cookie Name Validation in setCookie() CVE-2026-56762 Fix available 6.9 MediumApril 8, 2026
• hono Hono has a path traversal in toSSG() allows writing files outside the output directory CVE-2026-39408 Fix available 5.9 MediumApril 8, 2026
• hono Hono has a middleware bypass via repeated slashes in serveStatic CVE-2026-39407 Fix available 5.3 MediumApril 8, 2026
• hono node-server @hono/node-server has a middleware bypass via repeated slashes in serveStatic CVE-2026-39406 Fix available 5.3 MediumApril 8, 2026
• hono Hono - Prototype Pollution via __proto__ Key in parseBody with dot Option CVE-2026-56763 Fix available 6.3 MediumMarch 11, 2026
• hono node-server @hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware CVE-2026-29087 Fix available 7.5 HighMarch 4, 2026
• hono Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie() CVE-2026-29086 Fix available 5.4 MediumMarch 4, 2026
• hono Hono: SSE Control Field Injection via CR/LF in writeSSE() CVE-2026-29085 Fix available 6.5 MediumMarch 4, 2026
• hono Hono: Arbitrary file access via serveStatic vulnerability CVE-2026-29045 Fix available 7.5 HighMarch 4, 2026
• hono Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo CVE-2026-27700 Fix available 8.2 HighFebruary 25, 2026
• hono Hono - Timing Attack in basicAuth and bearerAuth Middleware CVE-2026-56764 Fix available 6.3 MediumFebruary 19, 2026
• hono Hono has a Cross-site Scripting vulnerability CVE-2026-24771 Fix available 4.7 MediumJanuary 27, 2026
• hono Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter) CVE-2026-24473 Fix available 6.3 MediumJanuary 27, 2026
• hono Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception CVE-2026-24472 Fix available 5.3 MediumJanuary 27, 2026
• hono Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing CVE-2026-24398 Fix available 4.8 MediumJanuary 27, 2026
• hono JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass CVE-2026-22817 Fix available 8.2 HighJanuary 13, 2026
• hono JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback) CVE-2026-22818 Fix available 8.2 HighJanuary 13, 2026
• hono Hono - Vary Header Injection in CORS Middleware CVE-2025-71381 Fix available 6.9 MediumOctober 24, 2025
• hono Hono Improperly Authorizes JWT Audience Validation CVE-2025-62610 Fix available 8.1 HighOctober 22, 2025
• hono Hono has Body Limit Middleware Bypass CVE-2025-59139 Public exploitFix available 5.3 MediumSeptember 12, 2025
• hono Hono contains a flaw in URL path parsing, potentially leading to path confusion CVE-2025-58362 Fix available 7.5 HighSeptember 3, 2025
• hono Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header. CVE-2024-48913 Fix available 5.9 MediumOctober 15, 2024
• eclipse hono Hono CSRF middleware can be bypassed using crafted Content-Type header CVE-2024-43787 Fix available 5.0 MediumAugust 22, 2024
• hono Hono vulnerable to Restricted Directory Traversal in serveStatic with deno CVE-2024-32869 Fix available 5.3 MediumApril 23, 2024
• hono node-server @hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed CVE-2024-32652 Fix available 7.5 HighApril 19, 2024
• hono node-server @hono/node-server can't handle "double dots" in URL CVE-2024-23340 Fix available 5.3 MediumJanuary 22, 2024
• hono Hono's named path parameters can be overridden in TrieRouter CVE-2023-50710 Fix available 4.2 MediumDecember 14, 2023