Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

hono/jsx does not isolate context per request, leading to cross-request data disclosure

Hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`

Hono: JWT middleware accepts any Authorization scheme, not only Bearer

Hono: bodyLimit() can be bypassed for chunked / unknown-length requests

Hono: SSE Control Field Injection via CR/LF in writeSSE()

Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing

JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass

JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)

Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection

Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.

Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()

Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding

Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

Hono: ReDoS in CORS middleware via Access-Control-Request-Headers

Hono: Algorithmic Complexity DoS in Language Middleware

Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

Hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice

Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

Hono has a middleware bypass via repeated slashes in serveStatic

Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)

Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception

Hono has Body Limit Middleware Bypass

Hono CSRF middleware can be bypassed using crafted Content-Type header

Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

Hono has a non-breaking space prefix bypass in cookie name handling in getCookie()

hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

Hono has a Cross-site Scripting vulnerability

Hono: CSS Declaration Injection via Style Object Values in JSX SSR