Honojs vulnerabilities
55 CVEs and advisories name Honojs as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-118663@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
- CVE-2026-111757Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
- CVE-2026-109955Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding
- CVE-2026-93981hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings
- CVE-2026-84365Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory
- CVE-2026-84364Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion
- CVE-2026-84363Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
- CVE-2026-81888@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking
- CVE-2026-73565@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake
- CVE-2026-69207Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
- CVE-2026-71850Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure
- CVE-2026-71849Hono: Proxy Helper does not remove response headers listed in the `Connection` header
- CVE-2026-71848Hono: Algorithmic Complexity DoS in Language Middleware
- CVE-2026-59895Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility
- CVE-2026-59896hono/jsx does not isolate context per request, leading to cross-request data disclosure
- CVE-2026-59897Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication
- CVE-2026-54288Hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`
- CVE-2026-54289Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest
- CVE-2026-54290Hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard
- CVE-2026-54286Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
- CVE-2026-54287Hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice
- CVE-2026-47673Hono: JWT middleware accepts any Authorization scheme, not only Bearer
- CVE-2026-47674Hono: IP Restriction bypasses static deny rules for non-canonical IPv6
- CVE-2026-47675Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection
- CVE-2026-47676Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths
- CVE-2026-44459Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()
- CVE-2026-44458Hono: CSS Declaration Injection via Style Object Values in JSX SSR
- CVE-2026-44457Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage
- CVE-2026-44456Hono: bodyLimit() can be bypassed for chunked / unknown-length requests
- CVE-2026-44455Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection