# hono (npm) vulnerabilities 53 known vulnerabilities (7 high, 43 medium, 3 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Weekly downloads: 100.9M - Dependents: 102.2K - Registry: https://www.npmjs.com/package/hono ## Advisories (53) ### [CVE-2026-111757](https://cve.now/CVE-2026-111757): Hono: \`serveStatic\` decodes the request path a second time, leading to bypass of middleware on static paths - Severity: Medium 5.3 - Published: Oct 19, 2026 - Affected: from 4.12.4, fixed in 4.13.11. ### [CVE-2026-109955](https://cve.now/CVE-2026-109955): Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding - Severity: Medium 6.9 - Published: Oct 13, 2026 - Affected: from 4.12.4, fixed in 4.13.11. ### [CVE-2026-93981](https://cve.now/CVE-2026-93981): hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings - Severity: Low 2.3 - Published: Sep 19, 2026 - Affected: fixed in 4.13.7. ### [CVE-2026-84365](https://cve.now/CVE-2026-84365): Hono: Incomplete fix for CVE-2026-39408: \`toSSG()\` still writes files outside the output directory - Severity: Medium 6.5 - Published: Sep 1, 2026 - Affected: fixed in 4.13.5. ### [CVE-2026-84364](https://cve.now/CVE-2026-84364): Hono: Unbounded dot-notation nesting in \`parseBody()\` can cause memory exhaustion - Severity: Medium 5.3 - Published: Sep 1, 2026 - Affected: fixed in 4.13.5. ### [CVE-2026-84363](https://cve.now/CVE-2026-84363): Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials - Severity: Medium 5.9 - Published: Sep 1, 2026 - Affected: fixed in 4.13.5. ### [CVE-2026-69207](https://cve.now/CVE-2026-69207): Hono: ReDoS in CORS middleware via Access-Control-Request-Headers - Severity: Medium 5.3 - Published: Aug 7, 2026 - Affected: fixed in 4.12.34. ### [CVE-2026-71850](https://cve.now/CVE-2026-71850): Hono: \`memo()\` retains SSR output across requests, leading to cross-user data disclosure - Severity: Medium 4.8 - Published: Aug 7, 2026 - Affected: from 3.8.0, fixed in 4.12.34. ### [CVE-2026-71849](https://cve.now/CVE-2026-71849): Hono: Proxy Helper does not remove response headers listed in the \`Connection\` header - Severity: Low 3.7 - Published: Aug 7, 2026 - Affected: from 4.7.0, fixed in 4.12.34. ### [CVE-2026-71848](https://cve.now/CVE-2026-71848): Hono: Algorithmic Complexity DoS in Language Middleware - Severity: Medium 5.3 - Published: Aug 7, 2026 - Affected: from 4.12.0, fixed in 4.12.34. ### [CVE-2026-56764](https://cve.now/CVE-2026-56764): Hono - Timing Attack in basicAuth and bearerAuth Middleware - Severity: Medium 6.3 - Published: Jul 15, 2026 - Affected: fixed in 4.11.10. ### [CVE-2026-56763](https://cve.now/CVE-2026-56763): Hono - Prototype Pollution via proto Key in parseBody with dot Option - Severity: Medium 6.3 - Published: Jul 11, 2026 - Affected: fixed in 4.12.7. ### [CVE-2026-59895](https://cve.now/CVE-2026-59895): Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility - Severity: Medium 6.1 - Published: Jul 8, 2026 - Affected: from 4.0.0, fixed in 4.12.27. ### [CVE-2026-59896](https://cve.now/CVE-2026-59896): hono/jsx does not isolate context per request, leading to cross-request data disclosure - Severity: Medium 6.5 - Published: Jul 8, 2026 - Affected: from 4.11.8, fixed in 4.12.27. ### [CVE-2026-59897](https://cve.now/CVE-2026-59897): Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication - Severity: Medium 4.8 - Published: Jul 8, 2026 - Affected: from 4.3.3, fixed in 4.12.27. ### [CVE-2025-71381](https://cve.now/CVE-2025-71381): Hono - Vary Header Injection in CORS Middleware - Severity: Medium 6.9 - Published: Jun 30, 2026 - Affected: fixed in 4.10.3. ### [CVE-2026-56761](https://cve.now/CVE-2026-56761): hono - HTML Injection via Improper JSX Attribute Name Handling in SSR - Severity: Medium 5.3 - Published: Jun 24, 2026 - Affected: fixed in 4.12.14. ### [CVE-2026-56762](https://cve.now/CVE-2026-56762): Hono - Missing Cookie Name Validation in setCookie() - Severity: Medium 6.9 - Published: Jun 23, 2026 - Affected: fixed in 4.12.12. ### [CVE-2026-54288](https://cve.now/CVE-2026-54288): Hono: Body Limit Middleware can be bypassed on AWS Lambda by understating \`Content-Length\` - Severity: Medium 6.5 - Published: Jun 22, 2026 - Affected: fixed in 4.12.25. ### [CVE-2026-54289](https://cve.now/CVE-2026-54289): Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest - Severity: Medium 4.8 - Published: Jun 22, 2026 - Affected: fixed in 4.12.25. ### [CVE-2026-54290](https://cve.now/CVE-2026-54290): Hono: CORS Middleware reflects any Origin with credentials when \`origin\` defaults to the wildcard - Severity: High 7.1 - Published: Jun 22, 2026 - Affected: fixed in 4.12.25. ### [CVE-2026-54286](https://cve.now/CVE-2026-54286): Hono: Path traversal in \`serve-static\` on Windows via encoded backslash (\`%5C\`) - Severity: Medium 5.9 - Published: Jun 22, 2026 - Affected: fixed in 4.12.25. ### [CVE-2026-54287](https://cve.now/CVE-2026-54287): Hono: AWS Lambda adapter merges multiple \`Set-Cookie\` headers into one value, dropping cookies on ALB single-header and Lattice - Severity: Medium 5.3 - Published: Jun 22, 2026 - Affected: fixed in 4.12.25. ### [CVE-2026-47673](https://cve.now/CVE-2026-47673): Hono: JWT middleware accepts any Authorization scheme, not only Bearer - Severity: Medium 4.8 - Published: May 28, 2026 - Affected: fixed in 4.12.21. ### [CVE-2026-47674](https://cve.now/CVE-2026-47674): Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 - Severity: Medium 5.3 - Published: May 28, 2026 - Affected: fixed in 4.12.21. ### [CVE-2026-47675](https://cve.now/CVE-2026-47675): Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection - Severity: Medium 4.3 - Published: May 28, 2026 - Affected: fixed in 4.12.21. ### [CVE-2026-47676](https://cve.now/CVE-2026-47676): Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths - Severity: Medium 5.3 - Published: May 28, 2026 - Affected: fixed in 4.12.21. ### [CVE-2026-44459](https://cve.now/CVE-2026-44459): Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify() - Severity: Low 3.8 - Published: May 13, 2026 - Affected: fixed in 4.12.18. ### [CVE-2026-44458](https://cve.now/CVE-2026-44458): Hono: CSS Declaration Injection via Style Object Values in JSX SSR - Severity: Medium 4.3 - Published: May 13, 2026 - Affected: fixed in 4.12.18. ### [CVE-2026-44457](https://cve.now/CVE-2026-44457): Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage - Severity: Medium 5.3 - Published: May 13, 2026 - Affected: fixed in 4.12.18. ### [CVE-2026-44456](https://cve.now/CVE-2026-44456): Hono: bodyLimit() can be bypassed for chunked / unknown-length requests - Severity: Medium 6.5 - Published: May 13, 2026 - Affected: fixed in 4.12.16. ### [CVE-2026-44455](https://cve.now/CVE-2026-44455): Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection - Severity: Medium 4.7 - Published: May 13, 2026 - Affected: fixed in 4.12.16. ### [CVE-2026-39410](https://cve.now/CVE-2026-39410): Hono has a non-breaking space prefix bypass in cookie name handling in getCookie() - Severity: Medium 4.8 - Published: Apr 8, 2026 - Affected: fixed in 4.12.12. ### [CVE-2026-39409](https://cve.now/CVE-2026-39409): Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses - Severity: Medium 6.3 - Published: Apr 8, 2026 - Affected: fixed in 4.12.12. ### [CVE-2026-39408](https://cve.now/CVE-2026-39408): Hono has a path traversal in toSSG() allows writing files outside the output directory - Severity: Medium 5.9 - Published: Apr 8, 2026 - Affected: from 4.0.0, fixed in 4.12.12. ### [CVE-2026-39407](https://cve.now/CVE-2026-39407): Hono has a middleware bypass via repeated slashes in serveStatic - Severity: Medium 5.3 - Published: Apr 8, 2026 - Affected: fixed in 4.12.12. ### [CVE-2026-29085](https://cve.now/CVE-2026-29085): Hono: SSE Control Field Injection via CR/LF in writeSSE() - Severity: Medium 6.5 - Published: Mar 4, 2026 - Affected: fixed in 4.12.4. ### [CVE-2026-29045](https://cve.now/CVE-2026-29045): Hono: Arbitrary file access via serveStatic vulnerability - Severity: High 7.5 - Published: Mar 4, 2026 - Affected: fixed in 4.12.4. ### [CVE-2026-29086](https://cve.now/CVE-2026-29086): Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie() - Severity: Medium 5.4 - Published: Mar 4, 2026 - Affected: fixed in 4.12.4. ### [CVE-2026-27700](https://cve.now/CVE-2026-27700): Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo - Severity: High 8.2 - Published: Feb 25, 2026 - Affected: from 4.12.0, fixed in 4.12.2. ### [CVE-2026-24771](https://cve.now/CVE-2026-24771): Hono has a Cross-site Scripting vulnerability - Severity: Medium 4.7 - Published: Jan 27, 2026 - Affected: fixed in 4.11.7. ### [CVE-2026-24473](https://cve.now/CVE-2026-24473): Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter) - Severity: Medium 6.3 - Published: Jan 27, 2026 - Affected: fixed in 4.11.7. ### [CVE-2026-24472](https://cve.now/CVE-2026-24472): Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception - Severity: Medium 5.3 - Published: Jan 27, 2026 - Affected: fixed in 4.11.7. ### [CVE-2026-24398](https://cve.now/CVE-2026-24398): Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing - Severity: Medium 4.8 - Published: Jan 27, 2026 - Affected: fixed in 4.11.7. ### [CVE-2026-22817](https://cve.now/CVE-2026-22817): JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass - Severity: High 8.2 - Published: Jan 13, 2026 - Affected: fixed in 4.11.4. ### [CVE-2026-22818](https://cve.now/CVE-2026-22818): JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback) - Severity: High 8.2 - Published: Jan 13, 2026 - Affected: fixed in 4.11.4. ### [CVE-2025-62610](https://cve.now/CVE-2025-62610): Hono Improperly Authorizes JWT Audience Validation - Severity: High 8.1 - Published: Oct 22, 2025 - Affected: from 1.1.0, fixed in 4.10.2. ### [CVE-2025-59139](https://cve.now/CVE-2025-59139): Hono has Body Limit Middleware Bypass - Severity: Medium 5.3 - Published: Sep 12, 2025 - Affected: fixed in 4.9.7. ### [CVE-2025-58362](https://cve.now/CVE-2025-58362): Hono contains a flaw in URL path parsing, potentially leading to path confusion - Severity: High 7.5 - Published: Sep 4, 2025 - Affected: from 4.8.0, fixed in 4.9.6. ### [CVE-2024-48913](https://cve.now/CVE-2024-48913): Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header. - Severity: Medium 5.9 - Published: Oct 15, 2024 - Affected: fixed in 4.6.5. ### [CVE-2024-43787](https://cve.now/CVE-2024-43787): Hono CSRF middleware can be bypassed using crafted Content-Type header - Severity: Medium 5.0 - Published: Aug 22, 2024 - Affected: fixed in 4.5.8. ### [CVE-2024-32869](https://cve.now/CVE-2024-32869): Hono vulnerable to Restricted Directory Traversal in serveStatic with deno - Severity: Medium 5.3 - Published: Apr 23, 2024 - Affected: fixed in 4.2.7. ### [CVE-2023-50710](https://cve.now/CVE-2023-50710): Hono's named path parameters can be overridden in TrieRouter - Severity: Medium 4.2 - Published: Dec 14, 2023 - Affected: fixed in 3.11.7. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/hono Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.