Login Request a demo
HO
Vendor
honojs
3 products with CVEs on record
51
CVEs
0
On KEV
3
New 30D
Products
HO
hono
honojs
9.8
46 CVEs0 on KEV2 new
NO
node-server
honojs
7.5
4 CVEs0 on KEV1 new
HO
@hono/oauth-providers
honojs
5.4
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-118663
New
NO
node-server
honojs
5.3–Oct 28@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
CVE-2026-111757
HO
hono
honojs
5.3
0%
Oct 19Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
CVE-2026-109955
HO
hono
honojs
5.3
0%
Oct 13Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding
CVE-2026-93981
HO
hono
honojs
4.7
0%
Sep 19hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings
CVE-2026-84365
HO
hono
honojs
6.5
0%
Sep 1Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory
CVE-2026-84364
HO
hono
honojs
5.3
1%
Sep 1Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion
CVE-2026-84363
HO
hono
honojs
5.9
0%
Sep 1Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
CVE-2026-81888
HO
@hono/oauth-providers
honojs
5.4
0%
Aug 31@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking
CVE-2026-73565
NO
node-server
honojs
5.3
1%
Aug 13@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake
CVE-2026-69207
HO
hono
honojs
5.3
1%
Aug 7Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
CVE-2026-71850
HO
hono
honojs
4.8
0%
Aug 7Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure
CVE-2026-71849
HO
hono
honojs
3.7
0%
Aug 7Hono: Proxy Helper does not remove response headers listed in the `Connection` header
CVE-2026-71848
HO
hono
honojs
5.3
1%
Aug 7Hono: Algorithmic Complexity DoS in Language Middleware
CVE-2026-59895
HO
hono
honojs
6.1
0%
Jul 8Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility
CVE-2026-59896
HO
hono
honojs
6.5
0%
Jul 8hono/jsx does not isolate context per request, leading to cross-request data disclosure
CVE-2026-59897
HO
hono
honojs
5.3
0%
Jul 8Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication
CVE-2026-54288
HO
hono
honojs
6.5
0%
Jun 22Hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`
CVE-2026-54289
HO
hono
honojs
4.8
0%
Jun 22Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest
CVE-2026-54290
HO
hono
honojs
7.1
0%
Jun 22Hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard
CVE-2026-54286
HO
hono
honojs
5.9
0%
Jun 22Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
CVE-2026-54287
HO
hono
honojs
5.3
0%
Jun 22Hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice
CVE-2026-47673
HO
hono
honojs
6.5
0%
May 28Hono: JWT middleware accepts any Authorization scheme, not only Bearer
CVE-2026-47674
HO
hono
honojs
5.3
0%
May 28Hono: IP Restriction bypasses static deny rules for non-canonical IPv6
CVE-2026-47675
HO
hono
honojs
5.3
0%
May 28Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection
CVE-2026-47676
HO
hono
honojs
5.3
0%
May 28Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths
CVE-2026-44459
HO
hono
honojs
3.8
0%
May 13Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()
CVE-2026-44458
HO
hono
honojs
4.3
0%
May 13Hono: CSS Declaration Injection via Style Object Values in JSX SSR
CVE-2026-44457
HO
hono
honojs
5.3
0%
May 13Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage
CVE-2026-44456
HO
hono
honojs
6.5
0%
May 13Hono: bodyLimit() can be bypassed for chunked / unknown-length requests
CVE-2026-44455
HO
hono
honojs
6.1
0%
May 13Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection
CVE-2026-39410
HO
hono
honojs
4.8
0%
Apr 8Hono has a non-breaking space prefix bypass in cookie name handling in getCookie()
CVE-2026-39409
HO
hono
honojs
5.3
0%
Apr 8Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses
CVE-2026-39408
HO
hono
honojs
7.5
1%
Apr 8Hono has a path traversal in toSSG() allows writing files outside the output directory
CVE-2026-39407
HO
hono
honojs
5.3
0%
Apr 8Hono has a middleware bypass via repeated slashes in serveStatic
CVE-2026-39406
NO
node-server
honojs
5.3
0%
Apr 8@hono/node-server has a middleware bypass via repeated slashes in serveStatic
CVE-2026-29087
NO
node-server
honojs
7.5
0%
Mar 6@hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
CVE-2026-29085
HO
hono
honojs
6.5
0%
Mar 4Hono: SSE Control Field Injection via CR/LF in writeSSE()
CVE-2026-29045
HO
hono
honojs
9.8
1%
Mar 4Hono: Arbitrary file access via serveStatic vulnerability
CVE-2026-29086
HO
hono
honojs
5.4
0%
Mar 4Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()
CVE-2026-27700
HO
hono
honojs
7.5
0%
Feb 25Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
CVE-2026-24771
HO
hono
honojs
4.7
0%
Jan 27Hono has a Cross-site Scripting vulnerability
CVE-2026-24473
HO
hono
honojs
5.3
0%
Jan 27Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)
CVE-2026-24472
HO
hono
honojs
5.3
1%
Jan 27Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception
CVE-2026-24398
HO
hono
honojs
6.5
0%
Jan 27Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing
CVE-2026-22817
HO
hono
honojs
6.5
0%
Jan 13JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass
CVE-2026-22818
HO
hono
honojs
6.5
0%
Jan 13JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)
CVE-2025-62610
HO
hono
honojs
8.1
0%
Oct 22Hono Improperly Authorizes JWT Audience Validation
CVE-2025-59139
HO
hono
honojs
5.3
0%
Sep 12Hono has Body Limit Middleware Bypass
CVE-2025-58362
HO
hono
honojs
7.5
1%
Sep 4Hono contains a flaw in URL path parsing, potentially leading to path confusion
CVE-2024-48913
HO
hono
honojs
5.9
0%
Oct 15Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.
CVE-2024-43787
HO
hono
honojs
5.0
0%
Aug 22Hono CSRF middleware can be bypassed using crafted Content-Type header