CVEs we hold for Honojs

Records whose assigning authority named Honojs as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-84365Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directoryhonojs hono

CVE-2026-84364Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustionhonojs hono

CVE-2026-84363Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentialshonojs hono

CVE-2026-81888@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linkinghonojs @hono/oauth-providers

CVE-2026-73565@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshakehonojs node-server

CVE-2026-71850Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosurehonojs hono

CVE-2026-71849Hono: Proxy Helper does not remove response headers listed in the `Connection` headerhonojs hono

CVE-2026-71848Hono: Algorithmic Complexity DoS in Language Middlewarehonojs hono

CVE-2026-69207Hono: ReDoS in CORS middleware via Access-Control-Request-Headershonojs hono

CVE-2026-59897Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplicationhonojs hono

CVE-2026-59896hono/jsx does not isolate context per request, leading to cross-request data disclosurehonojs hono

CVE-2026-59895Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utilityhonojs hono

CVE-2026-54290Hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcardhonojs hono

CVE-2026-54289Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the resthonojs hono

CVE-2026-54288Hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`honojs hono

CVE-2026-54287Hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and…honojs hono

CVE-2026-54286Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)honojs hono

CVE-2026-47676Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded pathshonojs hono

CVE-2026-47675Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injectionhonojs hono

CVE-2026-47674Hono: IP Restriction bypasses static deny rules for non-canonical IPv6honojs hono

CVE-2026-47673Hono: JWT middleware accepts any Authorization scheme, not only Bearerhonojs hono

CVE-2026-44459Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()honojs hono

CVE-2026-44458Hono: CSS Declaration Injection via Style Object Values in JSX SSRhonojs hono

CVE-2026-44457Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakagehonojs hono

CVE-2026-44456Hono: bodyLimit() can be bypassed for chunked / unknown-length requestshonojs hono

CVE-2026-44455Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injectionhonojs hono

CVE-2026-39410Hono has a non-breaking space prefix bypass in cookie name handling in getCookie()honojs hono

CVE-2026-39409Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresseshonojs hono

CVE-2026-39408Hono has a path traversal in toSSG() allows writing files outside the output directoryhonojs hono

CVE-2026-39407Hono has a middleware bypass via repeated slashes in serveStatichonojs hono

CVE-2026-39406@hono/node-server has a middleware bypass via repeated slashes in serveStatichonojs node-server

CVE-2026-29087@hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middlewarehonojs node-server

CVE-2026-29086Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()honojs hono

CVE-2026-29085Hono: SSE Control Field Injection via CR/LF in writeSSE()honojs hono

CVE-2026-29045Hono: Arbitrary file access via serveStatic vulnerabilityhonojs hono

CVE-2026-27700Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfohonojs hono

CVE-2026-24771Hono has a Cross-site Scripting vulnerabilityhonojs hono

CVE-2026-24473Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)honojs hono

CVE-2026-24472Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deceptionhonojs hono

CVE-2026-24398Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofinghonojs hono

CVE-2026-22818JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)honojs hono

CVE-2026-22817JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypasshonojs hono

CVE-2025-62610Hono Improperly Authorizes JWT Audience Validationhonojs hono

CVE-2025-59139Hono has Body Limit Middleware Bypasshonojs hono

CVE-2025-58362Hono contains a flaw in URL path parsing, potentially leading to path confusionhonojs hono

CVE-2024-48913Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.honojs hono

CVE-2024-43787Hono CSRF middleware can be bypassed using crafted Content-Type headerhonojs hono

CVE-2024-32869Hono vulnerable to Restricted Directory Traversal in serveStatic with denohonojs hono

CVE-2024-32652@hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsedhonojs node-server

CVE-2024-23340@hono/node-server can't handle "double dots" in URLhonojs node-server

CVE-2023-50710Hono's named path parameters can be overridden in TrieRouterhonojs hono

51 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.