Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

60 records

Vendor: honojs Clear all filters
TI-2026-71722 CVE-2026-109955 · GHSA-3g9q-qwv8-cxpf

Middleware bypass in Hono serveStatic via double path decoding

Priority LOW 36

Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00315 Published 2026-10-13 Partial fix · 4.13.11 CWE-174
TI-2026-63240 CVE-2026-93981 · GHSA-hxh3-vqpv-xpqv

hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

Priority LOW 11

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provid…

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00227 Published 2026-09-19 Partial fix · 4.13.7 CWE-79
TI-2026-40928 CVE-2026-56764 · GHSA-98q5-3v5r-qvfh

Hono - Timing Attack in basicAuth and bearerAuth Middleware

Priority LOW 28

Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00297 Published 2026-07-15 Partial fix · 4.11.10 CWE-208
TI-2026-40927 CVE-2026-56763 · GHSA-v8w9-8mx6-g223

Hono - Prototype Pollution via __proto__ Key in parseBody with dot Option

Priority LOW 28

Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00273 Published 2026-07-11 Fixed in 4.12.7 CWE-1321
TI-2025-43501 CVE-2025-71381 · GHSA-q7jf-gf43-6x6p

Hono - Vary Header Injection in CORS Middleware

Priority LOW 36

Hono before 4.10.3 contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00292 Published 2026-06-30 Fixed in 4.10.3 CWE-113
TI-2026-40925 CVE-2026-56761 · GHSA-458j-xx4x-4375

hono - HTML Injection via Improper JSX Attribute Name Handling in SSR

Priority LOW 24

hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00293 Published 2026-06-24 Fixed in 4.12.14 CWE-79
TI-2026-40926 CVE-2026-56762 · GHSA-26pp-8wgv-hjvm

Hono - Missing Cookie Name Validation in setCookie()

Priority LOW 37

Hono before 4.12.12 does not validate cookie names on the write path in the setCookie(), serialize(), and serializeSigned() functions, allowing invalid characters such as control characters (e.g.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00418 Published 2026-06-23 Fixed in 4.12.12 CWE-20
Load more