# cve.now: Honojs

The newest entries naming Honojs as an affected vendor (up to 200), of 55 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-118663](https://cve.now/CVE-2026-118663.md): @hono/node-server: \`serveStatic\` decodes the request path a second time, leading to bypass of middleware on static paths (CVSS 5.3)
- [CVE-2026-111757](https://cve.now/CVE-2026-111757.md): Hono: \`serveStatic\` decodes the request path a second time, leading to bypass of middleware on static paths (CVSS 5.3)
- [CVE-2026-109955](https://cve.now/CVE-2026-109955.md): Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding (CVSS 6.9)
- [CVE-2026-93981](https://cve.now/CVE-2026-93981.md): hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings (CVSS 2.3)
- [CVE-2026-84365](https://cve.now/CVE-2026-84365.md): Hono: Incomplete fix for CVE-2026-39408: \`toSSG()\` still writes files outside the output directory (CVSS 6.5)
- [CVE-2026-84364](https://cve.now/CVE-2026-84364.md): Hono: Unbounded dot-notation nesting in \`parseBody()\` can cause memory exhaustion (CVSS 5.3)
- [CVE-2026-84363](https://cve.now/CVE-2026-84363.md): Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials (CVSS 5.9)
- [CVE-2026-81888](https://cve.now/CVE-2026-81888.md): @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking (CVSS 5.4)
- [CVE-2026-73565](https://cve.now/CVE-2026-73565.md): @hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake (CVSS 5.3)
- [CVE-2026-69207](https://cve.now/CVE-2026-69207.md): Hono: ReDoS in CORS middleware via Access-Control-Request-Headers (CVSS 5.3)
- [CVE-2026-71850](https://cve.now/CVE-2026-71850.md): Hono: \`memo()\` retains SSR output across requests, leading to cross-user data disclosure (CVSS 4.8)
- [CVE-2026-71849](https://cve.now/CVE-2026-71849.md): Hono: Proxy Helper does not remove response headers listed in the \`Connection\` header (CVSS 3.7)
- [CVE-2026-71848](https://cve.now/CVE-2026-71848.md): Hono: Algorithmic Complexity DoS in Language Middleware (CVSS 5.3)
- [CVE-2026-59895](https://cve.now/CVE-2026-59895.md): Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility (CVSS 6.1)
- [CVE-2026-59896](https://cve.now/CVE-2026-59896.md): hono/jsx does not isolate context per request, leading to cross-request data disclosure (CVSS 6.5)
- [CVE-2026-59897](https://cve.now/CVE-2026-59897.md): Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication (CVSS 4.8)
- [CVE-2026-54288](https://cve.now/CVE-2026-54288.md): Hono: Body Limit Middleware can be bypassed on AWS Lambda by understating \`Content-Length\` (CVSS 6.5)
- [CVE-2026-54289](https://cve.now/CVE-2026-54289.md): Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest (CVSS 4.8)
- [CVE-2026-54290](https://cve.now/CVE-2026-54290.md): Hono: CORS Middleware reflects any Origin with credentials when \`origin\` defaults to the wildcard (CVSS 7.1)
- [CVE-2026-54286](https://cve.now/CVE-2026-54286.md): Hono: Path traversal in \`serve-static\` on Windows via encoded backslash (\`%5C\`) (CVSS 5.9)
- [CVE-2026-54287](https://cve.now/CVE-2026-54287.md): Hono: AWS Lambda adapter merges multiple \`Set-Cookie\` headers into one value, dropping cookies on ALB single-header and Lattice (CVSS 5.3)
- [CVE-2026-47673](https://cve.now/CVE-2026-47673.md): Hono: JWT middleware accepts any Authorization scheme, not only Bearer (CVSS 4.8)
- [CVE-2026-47674](https://cve.now/CVE-2026-47674.md): Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 (CVSS 5.3)
- [CVE-2026-47675](https://cve.now/CVE-2026-47675.md): Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection (CVSS 4.3)
- [CVE-2026-47676](https://cve.now/CVE-2026-47676.md): Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths (CVSS 5.3)
- [CVE-2026-44459](https://cve.now/CVE-2026-44459.md): Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify() (CVSS 3.8)
- [CVE-2026-44458](https://cve.now/CVE-2026-44458.md): Hono: CSS Declaration Injection via Style Object Values in JSX SSR (CVSS 4.3)
- [CVE-2026-44457](https://cve.now/CVE-2026-44457.md): Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage (CVSS 5.3)
- [CVE-2026-44456](https://cve.now/CVE-2026-44456.md): Hono: bodyLimit() can be bypassed for chunked / unknown-length requests (CVSS 6.5)
- [CVE-2026-44455](https://cve.now/CVE-2026-44455.md): Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection (CVSS 4.7)
- [CVE-2026-39410](https://cve.now/CVE-2026-39410.md): Hono has a non-breaking space prefix bypass in cookie name handling in getCookie() (CVSS 4.8)
- [CVE-2026-39409](https://cve.now/CVE-2026-39409.md): Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses (CVSS 6.3)
- [CVE-2026-39408](https://cve.now/CVE-2026-39408.md): Hono has a path traversal in toSSG() allows writing files outside the output directory (CVSS 5.9)
- [CVE-2026-39407](https://cve.now/CVE-2026-39407.md): Hono has a middleware bypass via repeated slashes in serveStatic (CVSS 5.3)
- [CVE-2026-39406](https://cve.now/CVE-2026-39406.md): @hono/node-server has a middleware bypass via repeated slashes in serveStatic (CVSS 5.3)
- [CVE-2026-29087](https://cve.now/CVE-2026-29087.md): @hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware (CVSS 7.5)
- [CVE-2026-29085](https://cve.now/CVE-2026-29085.md): Hono: SSE Control Field Injection via CR/LF in writeSSE() (CVSS 6.5)
- [CVE-2026-29045](https://cve.now/CVE-2026-29045.md): Hono: Arbitrary file access via serveStatic vulnerability (CVSS 7.5)
- [CVE-2026-29086](https://cve.now/CVE-2026-29086.md): Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie() (CVSS 5.4)
- [CVE-2026-27700](https://cve.now/CVE-2026-27700.md): Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo (CVSS 8.2)
- [CVE-2026-24771](https://cve.now/CVE-2026-24771.md): Hono has a Cross-site Scripting vulnerability (CVSS 4.7)
- [CVE-2026-24473](https://cve.now/CVE-2026-24473.md): Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter) (CVSS 6.3)
- [CVE-2026-24472](https://cve.now/CVE-2026-24472.md): Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception (CVSS 5.3)
- [CVE-2026-24398](https://cve.now/CVE-2026-24398.md): Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing (CVSS 4.8)
- [CVE-2026-22817](https://cve.now/CVE-2026-22817.md): JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass (CVSS 8.2)
- [CVE-2026-22818](https://cve.now/CVE-2026-22818.md): JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback) (CVSS 8.2)
- [CVE-2025-62610](https://cve.now/CVE-2025-62610.md): Hono Improperly Authorizes JWT Audience Validation (CVSS 8.1)
- [CVE-2025-59139](https://cve.now/CVE-2025-59139.md): Hono has Body Limit Middleware Bypass (CVSS 5.3)
- [CVE-2025-58362](https://cve.now/CVE-2025-58362.md): Hono contains a flaw in URL path parsing, potentially leading to path confusion (CVSS 7.5)
- [CVE-2024-48913](https://cve.now/CVE-2024-48913.md): Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header. (CVSS 5.9)
- [CVE-2024-43787](https://cve.now/CVE-2024-43787.md): Hono CSRF middleware can be bypassed using crafted Content-Type header (CVSS 5.0)
- [CVE-2024-32869](https://cve.now/CVE-2024-32869.md): Hono vulnerable to Restricted Directory Traversal in serveStatic with deno (CVSS 5.3)
- [CVE-2024-32652](https://cve.now/CVE-2024-32652.md): @hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed (CVSS 7.5)
- [CVE-2024-23340](https://cve.now/CVE-2024-23340.md): @hono/node-server can't handle "double dots" in URL (CVSS 5.3)
- [CVE-2023-50710](https://cve.now/CVE-2023-50710.md): Hono's named path parameters can be overridden in TrieRouter (CVSS 4.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/honojs
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.