Honojs vulnerabilities

Products

• Hono 54
• Node-server 6

Newest

• honojs node-server @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths CVE-2026-118663 Fix available 5.3 MediumOctober 28, 2026
• honojs hono Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths CVE-2026-111757 Fix available 5.3 MediumOctober 13, 2026
• honojs hono Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding CVE-2026-109955 Fix available 6.9 MediumOctober 13, 2026
• honojs hono hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings CVE-2026-93981 Fix available 2.3 LowSeptember 19, 2026
• honojs hono Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory CVE-2026-84365 Fix available 6.5 MediumSeptember 1, 2026
• honojs hono Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion CVE-2026-84364 Fix available 5.3 MediumSeptember 1, 2026
• honojs hono Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials CVE-2026-84363 Fix available 5.9 MediumSeptember 1, 2026
• honojs @hono/oauth-providers @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking CVE-2026-81888 Fix available 5.4 MediumAugust 31, 2026
• honojs hono Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure CVE-2026-71850 Fix available 4.8 MediumAugust 7, 2026
• honojs hono Hono: Proxy Helper does not remove response headers listed in the `Connection` header CVE-2026-71849 Fix available 3.7 LowAugust 7, 2026
• honojs hono Hono: Algorithmic Complexity DoS in Language Middleware CVE-2026-71848 Fix available 5.3 MediumAugust 7, 2026
• honojs hono Hono: ReDoS in CORS middleware via Access-Control-Request-Headers CVE-2026-69207 Fix available 5.3 MediumAugust 3, 2026
• honojs node-server @hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake CVE-2026-73565 Fix available 5.3 MediumJuly 21, 2026
• hono Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility CVE-2026-59895 Fix available 6.1 MediumJuly 8, 2026
• hono hono/jsx does not isolate context per request, leading to cross-request data disclosure CVE-2026-59896 Fix available 6.5 MediumJuly 8, 2026
• hono Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication CVE-2026-59897 Fix available 4.8 MediumJuly 8, 2026
• honojs hono Hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length` CVE-2026-54288 Fix available 6.5 MediumJune 16, 2026
• honojs hono Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest CVE-2026-54289 Fix available 4.8 MediumJune 16, 2026
• honojs hono Hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard CVE-2026-54290 Fix available 7.1 HighJune 16, 2026
• honojs hono Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) CVE-2026-54286 Fix available 5.9 MediumJune 16, 2026
• honojs hono Hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice CVE-2026-54287 Fix available 5.3 MediumJune 16, 2026
• hono Hono: JWT middleware accepts any Authorization scheme, not only Bearer CVE-2026-47673 Fix available 4.8 MediumMay 28, 2026
• hono Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 CVE-2026-47674 Fix available 5.3 MediumMay 28, 2026
• hono Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection CVE-2026-47675 Fix available 4.3 MediumMay 28, 2026
• hono Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths CVE-2026-47676 Fix available 5.3 MediumMay 28, 2026
• hono Hono: CSS Declaration Injection via Style Object Values in JSX SSR CVE-2026-44458 Fix available 4.3 MediumMay 9, 2026
• hono Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify() CVE-2026-44459 Fix available 3.8 LowMay 9, 2026
• hono Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage CVE-2026-44457 Fix available 5.3 MediumMay 9, 2026
• hono Hono: bodyLimit() can be bypassed for chunked / unknown-length requests CVE-2026-44456 Fix available 6.5 MediumMay 6, 2026
• hono Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection CVE-2026-44455 Fix available 4.7 MediumMay 6, 2026
• @clerk backend, nextjs, shared +31 more +33 more Clerk: Authorization bypass when combining organization, billing, or reverification checks CVE-2026-42349 Fix available 7.6 HighApril 30, 2026
• hono hono - HTML Injection via Improper JSX Attribute Name Handling in SSR CVE-2026-56761 Fix available 5.3 MediumApril 16, 2026
• hono Hono has a non-breaking space prefix bypass in cookie name handling in getCookie() CVE-2026-39410 Fix available 4.8 MediumApril 8, 2026
• hono Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses CVE-2026-39409 Fix available 6.3 MediumApril 8, 2026
• hono Hono - Missing Cookie Name Validation in setCookie() CVE-2026-56762 Fix available 6.9 MediumApril 8, 2026
• hono Hono has a path traversal in toSSG() allows writing files outside the output directory CVE-2026-39408 Fix available 5.9 MediumApril 8, 2026
• hono Hono has a middleware bypass via repeated slashes in serveStatic CVE-2026-39407 Fix available 5.3 MediumApril 8, 2026
• hono node-server @hono/node-server has a middleware bypass via repeated slashes in serveStatic CVE-2026-39406 Fix available 5.3 MediumApril 8, 2026
• hono Hono - Prototype Pollution via __proto__ Key in parseBody with dot Option CVE-2026-56763 Fix available 6.3 MediumMarch 11, 2026
• hono node-server @hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware CVE-2026-29087 Fix available 7.5 HighMarch 4, 2026
• hono Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie() CVE-2026-29086 Fix available 5.4 MediumMarch 4, 2026
• hono Hono: SSE Control Field Injection via CR/LF in writeSSE() CVE-2026-29085 Fix available 6.5 MediumMarch 4, 2026
• hono Hono: Arbitrary file access via serveStatic vulnerability CVE-2026-29045 Fix available 7.5 HighMarch 4, 2026
• hono Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo CVE-2026-27700 Fix available 8.2 HighFebruary 25, 2026
• hono Hono - Timing Attack in basicAuth and bearerAuth Middleware CVE-2026-56764 Fix available 6.3 MediumFebruary 19, 2026
• hono Hono has a Cross-site Scripting vulnerability CVE-2026-24771 Fix available 4.7 MediumJanuary 27, 2026
• hono Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter) CVE-2026-24473 Fix available 6.3 MediumJanuary 27, 2026
• hono Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception CVE-2026-24472 Fix available 5.3 MediumJanuary 27, 2026
• hono Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing CVE-2026-24398 Fix available 4.8 MediumJanuary 27, 2026
• hono JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass CVE-2026-22817 Fix available 8.2 HighJanuary 13, 2026
• Show olderLoading…