Skip to contentHonojs vulnerabilities
Newest
- honoJWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)CVE-2026-22818Fix available8.2 High
- honoHono - Vary Header Injection in CORS MiddlewareCVE-2025-71381Fix available6.9 Medium
- honoHono Improperly Authorizes JWT Audience ValidationCVE-2025-62610Fix available8.1 High
- honoHono has Body Limit Middleware BypassCVE-2025-59139Public exploitFix available5.3 Medium
- honoHono contains a flaw in URL path parsing, potentially leading to path confusionCVE-2025-58362Fix available7.5 High
- honoHono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.CVE-2024-48913Fix available5.9 Medium
- eclipse honoHono CSRF middleware can be bypassed using crafted Content-Type headerCVE-2024-43787Fix available5.0 Medium
- honoHono vulnerable to Restricted Directory Traversal in serveStatic with denoCVE-2024-32869Fix available5.3 Medium
- hono node-server@hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsedCVE-2024-32652Fix available7.5 High
- hono node-server@hono/node-server can't handle "double dots" in URLCVE-2024-23340Fix available5.3 Medium
- honoHono's named path parameters can be overridden in TrieRouterCVE-2023-50710Fix available4.2 Medium