honojs

Records60All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

honojs records in CISA KEV

No honojs vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Hono 34 records MEDIUM Node-server 4 records MEDIUM

Records

34 records in Hono · all components

TI-2024-21741 CVE-2024-32869 · GHSA-3mpf-rcc7-5347

Hono vulnerable to Restricted Directory Traversal in serveStatic with deno

MEDIUM 63

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00642 Published 2024-04-23 Fixed in 4.2.7 CWE-22

TI-2024-32610 CVE-2024-48913 · GHSA-2234-fmw7-43wr

Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.

MEDIUM 60

Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery (CSRF) middleware by a request without Content-Type header.

CVSS 3.1MEDIUM 5.9 Network No auth User interaction EPSS 0.00325 Published 2024-10-15 Fixed in 4.6.5 CWE-352

TI-2024-29381 CVE-2024-43787 · GHSA-rpfr-3m35-5vx5

Hono CSRF middleware can be bypassed using crafted Content-Type header

MEDIUM 56

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 3.1MEDIUM 5.0 Network No auth User interaction EPSS 0.00244 Published 2024-08-22 Fixed in 4.5.8 CWE-352

TI-2026-23190 CVE-2026-29045 · GHSA-q5qw-h33p-qvwr

Hono: Arbitrary file access via serveStatic vulnerability

MEDIUM 49

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00587 Published 2026-03-04 Fixed in 4.12.4 CWE-177

TI-2026-22076 CVE-2026-27700 · GHSA-xh87-mx6m-69f3

Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo

MEDIUM 41

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00269 Published 2026-02-25 Fixed in 4.12.2 CWE-290

TI-2026-18334 CVE-2026-22818 · GHSA-3vhc-576x-3qv4

JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)

MEDIUM 41

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00138 Published 2026-01-13 Fixed in 4.11.4 CWE-347

TI-2026-18333 CVE-2026-22817 · GHSA-f67f-6cw9-8mq4

JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass

MEDIUM 41

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00166 Published 2026-01-13 Fixed in 4.11.4 CWE-347

TI-2025-38825 CVE-2025-62610 · GHSA-m732-5p4w-x69g

Hono Improperly Authorizes JWT Audience Validation

LOW 37

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00384 Published 2025-10-22 Fixed in 4.10.2 CWE-285

TI-2026-23229 CVE-2026-29085 · GHSA-p6xx-57qc-3wxr

Hono: SSE Control Field Injection via CR/LF in writeSSE()

LOW 35

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00281 Published 2026-03-04 Fixed in 4.12.4 CWE-74

TI-2026-32396 CVE-2026-44456 · GHSA-9vqf-7f2p-gf9v

Hono: bodyLimit() can be bypassed for chunked / unknown-length requests

LOW 34

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00219 Published 2026-05-13 Fixed in 4.12.16 CWE-400

TI-2025-36151 CVE-2025-58362 · GHSA-9hp6-4448-45g2

Hono contains a flaw in URL path parsing, potentially leading to path confusion

LOW 34

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00576 Published 2025-09-04 Fixed in 4.9.6 CWE-706

TI-2026-28390 CVE-2026-39408 · GHSA-xf4j-xp2r-rqqx

Hono has a path traversal in toSSG() allows writing files outside the output directory

LOW 33

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 4.0MEDIUM 5.9 Local No auth No interaction EPSS 0.00513 Published 2026-04-08 Fixed in 4.12.12 CWE-22

TI-2026-19727 CVE-2026-24472 · GHSA-6wqw-2p9w-4vw4

Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception

LOW 31

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00517 Published 2026-01-27 Fixed in 4.11.7 CWE-524

TI-2026-35183 CVE-2026-47676 · GHSA-2gcr-mfcq-wcc3

Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

LOW 30

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0026 Published 2026-05-28 Fixed in 4.12.21 CWE-444

TI-2026-35181 CVE-2026-47674 · GHSA-xrhx-7g5j-rcj5

Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

LOW 30

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00244 Published 2026-05-28 Fixed in 4.12.21 CWE-1289

TI-2026-28389 CVE-2026-39407 · GHSA-wmmm-f939-6g9c

Hono has a middleware bypass via repeated slashes in serveStatic

LOW 30

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00467 Published 2026-04-08 Fixed in 4.12.12 CWE-22

TI-2025-36744 CVE-2025-59139 · GHSA-92vj-g62v-jqhh

Hono has Body Limit Middleware Bypass

LOW 30

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00446 Published 2025-09-12 Fixed in 4.9.7 CWE-400

TI-2026-42710 CVE-2026-59896 · GHSA-hvrm-45r6-mjfj

hono/jsx does not isolate context per request, leading to cross-request data disclosure

LOW 29

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00299 Published 2026-07-08 Partial fix · 4.12.27 CWE-362

TI-2026-32397 CVE-2026-44457 · GHSA-p77w-8qqv-26rm

Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

LOW 29

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00198 Published 2026-05-13 Fixed in 4.12.18 CWE-524

TI-2026-19728 CVE-2026-24473 · GHSA-w332-q679-j88p

Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)

LOW 29

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00475 Published 2026-01-27 Fixed in 4.11.7 CWE-200

TI-2026-19666 CVE-2026-24398 · GHSA-r354-f388-2fhh

Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing

LOW 29

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00342 Published 2026-01-27 Fixed in 4.11.7 CWE-185

TI-2026-35180 CVE-2026-47673 · GHSA-f577-qrjj-4474

Hono: JWT middleware accepts any Authorization scheme, not only Bearer

LOW 28

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00199 Published 2026-05-28 Fixed in 4.12.21 CWE-285

TI-2026-28391 CVE-2026-39409 · GHSA-xpcf-pg52-r92g

Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

LOW 28

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00349 Published 2026-04-08 Fixed in 4.12.12 CWE-180

TI-2026-42709 CVE-2026-59895 · GHSA-w62v-xxxg-mg59

Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

LOW 27

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00327 Published 2026-07-08 Partial fix · 4.12.27 CWE-116

TI-2026-32395 CVE-2026-44455 · GHSA-69xw-7hcm-h432

Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection

LOW 26

Hono is a Web application framework that provides support for any JavaScript runtime.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0014 Published 2026-05-13 Fixed in 4.12.16 CWE-74

Open these records in search →

Critical	1
High	8
Medium	48
Low	3
No CVSS	0