TI-2024-21741 CVE-2024-32869 · GHSA-3mpf-rcc7-5347
Hono vulnerable to Restricted Directory Traversal in serveStatic with deno
Priority MEDIUM 63
Hono is a Web application framework that provides support for any JavaScript runtime.
honojs
Records60All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high8CVSS 7.0–8.9
Exploited now
honojs records in CISA KEVNo honojs vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
60 records
TI-2024-15441 CVE-2024-23340 · GHSA-rjq5-w47x-x359
@hono/node-server can't handle "double dots" in URL
Priority MEDIUM 63
@hono/node-server is an adapter that allows users to run Hono applications on Node.js.
TI-2024-32610 CVE-2024-48913 · GHSA-2234-fmw7-43wr
Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.
Priority MEDIUM 60
Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery (CSRF) middleware by a request without Content-Type header.
TI-2024-29381 CVE-2024-43787 · GHSA-rpfr-3m35-5vx5
Hono CSRF middleware can be bypassed using crafted Content-Type header
Priority MEDIUM 56
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-39189 CVE-2026-54289 · GHSA-wgpf-jwqj-8h8p
Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest
Priority MEDIUM 55
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-23190 CVE-2026-29045 · GHSA-q5qw-h33p-qvwr
Hono: Arbitrary file access via serveStatic vulnerability
Priority MEDIUM 49
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-22076 CVE-2026-27700 · GHSA-xh87-mx6m-69f3
Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
Priority MEDIUM 41
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-18334 CVE-2026-22818 · GHSA-3vhc-576x-3qv4
JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)
Priority MEDIUM 41
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-18333 CVE-2026-22817 · GHSA-f67f-6cw9-8mq4
JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass
Priority MEDIUM 41
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2024-21534 CVE-2024-32652 · GHSA-hgxw-5xg3-69jx
@hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed
Priority MEDIUM 41
The adapter @hono/node-server allows you to run your Hono application on Node.js.
TI-2026-23231 CVE-2026-29087 · GHSA-wc8c-qw6v-h7f6
@hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
Priority LOW 39
@hono/node-server allows running the Hono application on Node.js.
TI-2026-40926 CVE-2026-56762 · GHSA-26pp-8wgv-hjvm
Hono - Missing Cookie Name Validation in setCookie()
Priority LOW 37
Hono before 4.12.12 does not validate cookie names on the write path in the setCookie(), serialize(), and serializeSigned() functions, allowing invalid characters such as control characters (e.g.
TI-2025-38825 CVE-2025-62610 · GHSA-m732-5p4w-x69g
Hono Improperly Authorizes JWT Audience Validation
Priority LOW 37
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-71722 CVE-2026-109955 · GHSA-3g9q-qwv8-cxpf
Middleware bypass in Hono serveStatic via double path decoding
Priority LOW 36
Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding.
TI-2025-43501 CVE-2025-71381 · GHSA-q7jf-gf43-6x6p
Hono - Vary Header Injection in CORS Middleware
Priority LOW 36
Hono before 4.10.3 contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response.
TI-2026-23229 CVE-2026-29085 · GHSA-p6xx-57qc-3wxr
Hono: SSE Control Field Injection via CR/LF in writeSSE()
Priority LOW 35
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-39188 CVE-2026-54288 · GHSA-rv63-4mwf-qqc2
Hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`
Priority LOW 34
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-32396 CVE-2026-44456 · GHSA-9vqf-7f2p-gf9v
Hono: bodyLimit() can be bypassed for chunked / unknown-length requests
Priority LOW 34
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2025-36151 CVE-2025-58362 · GHSA-9hp6-4448-45g2
Hono contains a flaw in URL path parsing, potentially leading to path confusion
Priority LOW 34
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-28390 CVE-2026-39408 · GHSA-xf4j-xp2r-rqqx
Hono has a path traversal in toSSG() allows writing files outside the output directory
Priority LOW 33
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-57975 CVE-2026-84364 · GHSA-g6gw-c38x-mqfc
Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion
Priority LOW 31
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-51655 CVE-2026-73565 · GHSA-9mqv-5hh9-4cgg
@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake
Priority LOW 31
@hono/node-server allows running the Hono application on Node.js.
TI-2026-50177 CVE-2026-71848 · GHSA-54fx-42gc-7vw4
Hono: Algorithmic Complexity DoS in Language Middleware
Priority LOW 31
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-39190 CVE-2026-54290 · GHSA-88fw-hqm2-52qc
Hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard
Priority LOW 31
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-19727 CVE-2026-24472 · GHSA-6wqw-2p9w-4vw4
Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception
Priority LOW 31
Hono is a Web application framework that provides support for any JavaScript runtime.