hono vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-44455Mediumhono: hono/jsx has Unvalidated JSX Tag Names that May Allow HTML InjectionCVE-2026-56761Mediumhono: hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSRCVE-2026-39410Mediumhono: Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()CVE-2026-39409Mediumhono: Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addressesCVE-2026-56762Mediumhono: Hono missing validation of cookie name on write path in setCookie()CVE-2026-39408Mediumhono: Hono: Path traversal in toSSG() allows writing files outside the output directoryCVE-2026-39407Mediumhono: Hono: Middleware bypass via repeated slashes in serveStaticCVE-2026-56763Mediumhono: Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })CVE-2026-29086Mediumhono: Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()CVE-2026-29085Mediumhono: Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()CVE-2026-29045Highhono: Hono vulnerable to arbitrary file access via serveStatic vulnerability CVE-2026-27700Highhono: Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfoGHSA-GQ3J-XVXP-8HRFLowhono: Hono added timing comparison hardening in basicAuth and bearerAuthCVE-2026-24771Mediumhono: Hono vulnerable to XSS through ErrorBoundary component CVE-2026-24473Mediumhono: Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)CVE-2026-24472Mediumhono: Hono cache middleware ignores "Cache-Control: private" leading to Web Cache DeceptionCVE-2026-24398Mediumhono: Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofingCVE-2026-22818Highhono: Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)CVE-2026-22817Highhono: Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth BypassCVE-2025-71381Mediumhono: Hono vulnerable to Vary Header Injection leading to potential CORS BypassCVE-2025-62610Highhono: Hono Improper Authorization vulnerabilityCVE-2025-59139Mediumhono: Hono has Body Limit Middleware BypassCVE-2025-58362Highhono: Hono's flaw in URL path parsing could cause path confusionCVE-2024-48913Mediumhono: Hono allows bypass of CSRF Middleware by a request without Content-Type header.CVE-2024-43787Lowhono: Hono CSRF middleware can be bypassed using crafted Content-Type header

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo