TI-2026-42709 CVE-2026-59895 · GHSA-w62v-xxxg-mg59
Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility
Priority LOW 27
Hono is a Web application framework that provides support for any JavaScript runtime.
Vulnerabilities
34 records
TI-2026-42710 CVE-2026-59896 · GHSA-hvrm-45r6-mjfj
hono/jsx does not isolate context per request, leading to cross-request data disclosure
Priority LOW 29
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-42711 CVE-2026-59897 · GHSA-xgm2-5f3f-mvvc
Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication
Priority LOW 23
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-40925 CVE-2026-56761 · GHSA-458j-xx4x-4375
hono - HTML Injection via Improper JSX Attribute Name Handling in SSR
Priority LOW 24
hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names.
TI-2026-35180 CVE-2026-47673 · GHSA-f577-qrjj-4474
Hono: JWT middleware accepts any Authorization scheme, not only Bearer
Priority LOW 28
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-35181 CVE-2026-47674 · GHSA-xrhx-7g5j-rcj5
Hono: IP Restriction bypasses static deny rules for non-canonical IPv6
Priority LOW 30
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-35182 CVE-2026-47675 · GHSA-3hrh-pfw6-9m5x
Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection
Priority LOW 23
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-35183 CVE-2026-47676 · GHSA-2gcr-mfcq-wcc3
Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths
Priority LOW 30
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-32399 CVE-2026-44459 · GHSA-hm8q-7f3q-5f36
Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()
Priority LOW 17
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-32398 CVE-2026-44458 · GHSA-qp7p-654g-cw7p
Hono: CSS Declaration Injection via Style Object Values in JSX SSR
Priority LOW 19
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-32397 CVE-2026-44457 · GHSA-p77w-8qqv-26rm
Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage
Priority LOW 29
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-32396 CVE-2026-44456 · GHSA-9vqf-7f2p-gf9v
Hono: bodyLimit() can be bypassed for chunked / unknown-length requests
Priority LOW 34
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-32395 CVE-2026-44455 · GHSA-69xw-7hcm-h432
Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection
Priority LOW 26
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-28392 CVE-2026-39410 · GHSA-r5rp-j6wh-rvv4
Hono has a non-breaking space prefix bypass in cookie name handling in getCookie()
Priority LOW 22
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-28391 CVE-2026-39409 · GHSA-xpcf-pg52-r92g
Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses
Priority LOW 28
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-28390 CVE-2026-39408 · GHSA-xf4j-xp2r-rqqx
Hono has a path traversal in toSSG() allows writing files outside the output directory
Priority LOW 33
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-28389 CVE-2026-39407 · GHSA-wmmm-f939-6g9c
Hono has a middleware bypass via repeated slashes in serveStatic
Priority LOW 30
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-23229 CVE-2026-29085 · GHSA-p6xx-57qc-3wxr
Hono: SSE Control Field Injection via CR/LF in writeSSE()
Priority LOW 35
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-23190 CVE-2026-29045 · GHSA-q5qw-h33p-qvwr
Hono: Arbitrary file access via serveStatic vulnerability
Priority MEDIUM 49
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-23230 CVE-2026-29086 · GHSA-5pq2-9x2x-5p6w
Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()
Priority LOW 24
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-22076 CVE-2026-27700 · GHSA-xh87-mx6m-69f3
Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
Priority MEDIUM 41
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-19972 CVE-2026-24771 · GHSA-9r54-q6cx-xmh5
Hono has a Cross-site Scripting vulnerability
Priority LOW 22
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-19728 CVE-2026-24473 · GHSA-w332-q679-j88p
Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)
Priority LOW 29
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-19727 CVE-2026-24472 · GHSA-6wqw-2p9w-4vw4
Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception
Priority LOW 31
Hono is a Web application framework that provides support for any JavaScript runtime.
TI-2026-19666 CVE-2026-24398 · GHSA-r354-f388-2fhh
Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing
Priority LOW 29
Hono is a Web application framework that provides support for any JavaScript runtime.