Skip to main content
cve.nowby Sazabi
← npm
npmPackage

hono

53 known vulnerabilities (7 high, 43 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
53 · 7 high, 43 medium, 3 low
Weekly downloads
100.9M
Dependents
102.2K
Registry
npm

Advisories 53

  • CVE-2026-111757Medium 5.3

    Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

    Affected: from 4.12.4, fixed in 4.13.11.

  • CVE-2026-109955Medium 6.9

    Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding

    Affected: from 4.12.4, fixed in 4.13.11.

  • hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

    Affected: fixed in 4.13.7.

  • CVE-2026-84365Medium 6.5

    Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

    Affected: fixed in 4.13.5.

  • CVE-2026-84364Medium 5.3

    Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

    Affected: fixed in 4.13.5.

  • CVE-2026-84363Medium 5.9

    Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

    Affected: fixed in 4.13.5.

  • CVE-2026-69207Medium 5.3

    Hono: ReDoS in CORS middleware via Access-Control-Request-Headers

    Affected: fixed in 4.12.34.

  • CVE-2026-71850Medium 4.8

    Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

    Affected: from 3.8.0, fixed in 4.12.34.

  • Hono: Proxy Helper does not remove response headers listed in the `Connection` header

    Affected: from 4.7.0, fixed in 4.12.34.

  • CVE-2026-71848Medium 5.3

    Hono: Algorithmic Complexity DoS in Language Middleware

    Affected: from 4.12.0, fixed in 4.12.34.

  • CVE-2026-56764Medium 6.3

    Hono - Timing Attack in basicAuth and bearerAuth Middleware

    Affected: fixed in 4.11.10.

  • CVE-2026-56763Medium 6.3

    Hono - Prototype Pollution via proto Key in parseBody with dot Option

    Affected: fixed in 4.12.7.

  • CVE-2026-59895Medium 6.1

    Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

    Affected: from 4.0.0, fixed in 4.12.27.

  • CVE-2026-59896Medium 6.5

    hono/jsx does not isolate context per request, leading to cross-request data disclosure

    Affected: from 4.11.8, fixed in 4.12.27.

  • CVE-2026-59897Medium 4.8

    Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

    Affected: from 4.3.3, fixed in 4.12.27.

Show all 53 advisoriesShow fewer advisories
  • CVE-2025-71381Medium 6.9

    Hono - Vary Header Injection in CORS Middleware

    Affected: fixed in 4.10.3.

  • CVE-2026-56761Medium 5.3

    hono - HTML Injection via Improper JSX Attribute Name Handling in SSR

    Affected: fixed in 4.12.14.

  • CVE-2026-56762Medium 6.9

    Hono - Missing Cookie Name Validation in setCookie()

    Affected: fixed in 4.12.12.

  • CVE-2026-54288Medium 6.5

    Hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`

    Affected: fixed in 4.12.25.

  • CVE-2026-54289Medium 4.8

    Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

    Affected: fixed in 4.12.25.

  • Hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard

    Affected: fixed in 4.12.25.

  • CVE-2026-54286Medium 5.9

    Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

    Affected: fixed in 4.12.25.

  • CVE-2026-54287Medium 5.3

    Hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice

    Affected: fixed in 4.12.25.

  • CVE-2026-47673Medium 4.8

    Hono: JWT middleware accepts any Authorization scheme, not only Bearer

    Affected: fixed in 4.12.21.

  • CVE-2026-47674Medium 5.3

    Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

    Affected: fixed in 4.12.21.

  • CVE-2026-47675Medium 4.3

    Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

    Affected: fixed in 4.12.21.

  • CVE-2026-47676Medium 5.3

    Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

    Affected: fixed in 4.12.21.

  • Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

    Affected: fixed in 4.12.18.

  • CVE-2026-44458Medium 4.3

    Hono: CSS Declaration Injection via Style Object Values in JSX SSR

    Affected: fixed in 4.12.18.

  • CVE-2026-44457Medium 5.3

    Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

    Affected: fixed in 4.12.18.

  • CVE-2026-44456Medium 6.5

    Hono: bodyLimit() can be bypassed for chunked / unknown-length requests

    Affected: fixed in 4.12.16.

  • CVE-2026-44455Medium 4.7

    Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection

    Affected: fixed in 4.12.16.

  • CVE-2026-39410Medium 4.8

    Hono has a non-breaking space prefix bypass in cookie name handling in getCookie()

    Affected: fixed in 4.12.12.

  • CVE-2026-39409Medium 6.3

    Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

    Affected: fixed in 4.12.12.

  • CVE-2026-39408Medium 5.9

    Hono has a path traversal in toSSG() allows writing files outside the output directory

    Affected: from 4.0.0, fixed in 4.12.12.

  • CVE-2026-39407Medium 5.3

    Hono has a middleware bypass via repeated slashes in serveStatic

    Affected: fixed in 4.12.12.

  • CVE-2026-29085Medium 6.5

    Hono: SSE Control Field Injection via CR/LF in writeSSE()

    Affected: fixed in 4.12.4.

  • Hono: Arbitrary file access via serveStatic vulnerability

    Affected: fixed in 4.12.4.

  • CVE-2026-29086Medium 5.4

    Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()

    Affected: fixed in 4.12.4.

  • Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo

    Affected: from 4.12.0, fixed in 4.12.2.

  • CVE-2026-24771Medium 4.7

    Hono has a Cross-site Scripting vulnerability

    Affected: fixed in 4.11.7.

  • CVE-2026-24473Medium 6.3

    Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)

    Affected: fixed in 4.11.7.

  • CVE-2026-24472Medium 5.3

    Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception

    Affected: fixed in 4.11.7.

  • CVE-2026-24398Medium 4.8

    Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing

    Affected: fixed in 4.11.7.

  • JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass

    Affected: fixed in 4.11.4.

  • JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)

    Affected: fixed in 4.11.4.

  • Hono Improperly Authorizes JWT Audience Validation

    Affected: from 1.1.0, fixed in 4.10.2.

  • CVE-2025-59139Medium 5.3

    Hono has Body Limit Middleware Bypass

    Affected: fixed in 4.9.7.

  • Hono contains a flaw in URL path parsing, potentially leading to path confusion

    Affected: from 4.8.0, fixed in 4.9.6.

  • CVE-2024-48913Medium 5.9

    Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.

    Affected: fixed in 4.6.5.

  • CVE-2024-43787Medium 5.0

    Hono CSRF middleware can be bypassed using crafted Content-Type header

    Affected: fixed in 4.5.8.

  • CVE-2024-32869Medium 5.3

    Hono vulnerable to Restricted Directory Traversal in serveStatic with deno

    Affected: fixed in 4.2.7.

  • CVE-2023-50710Medium 4.2

    Hono's named path parameters can be overridden in TrieRouter

    Affected: fixed in 3.11.7.