Honojs vulnerabilities
55 CVEs and advisories name Honojs as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-39410Hono has a non-breaking space prefix bypass in cookie name handling in getCookie()
- CVE-2026-39409Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses
- CVE-2026-39408Hono has a path traversal in toSSG() allows writing files outside the output directory
- CVE-2026-39407Hono has a middleware bypass via repeated slashes in serveStatic
- CVE-2026-39406@hono/node-server has a middleware bypass via repeated slashes in serveStatic
- CVE-2026-29087@hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
- CVE-2026-29085Hono: SSE Control Field Injection via CR/LF in writeSSE()
- CVE-2026-29045Hono: Arbitrary file access via serveStatic vulnerability
- CVE-2026-29086Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()
- CVE-2026-27700Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
- CVE-2026-24771Hono has a Cross-site Scripting vulnerability
- CVE-2026-24473Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)
- CVE-2026-24472Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception
- CVE-2026-24398Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing
- CVE-2026-22817JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass
- CVE-2026-22818JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)
- CVE-2025-62610Hono Improperly Authorizes JWT Audience Validation
- CVE-2025-59139Hono has Body Limit Middleware Bypass
- CVE-2025-58362Hono contains a flaw in URL path parsing, potentially leading to path confusion
- CVE-2024-48913Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.
- CVE-2024-43787Hono CSRF middleware can be bypassed using crafted Content-Type header
- CVE-2024-32869Hono vulnerable to Restricted Directory Traversal in serveStatic with deno
- CVE-2024-32652@hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed
- CVE-2024-23340@hono/node-server can't handle "double dots" in URL
- CVE-2023-50710Hono's named path parameters can be overridden in TrieRouter