Vendor
Hono
42 known vulnerabilities in products by Hono, 0 of them actively exploited (CISA KEV).
Key figures
42
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-29045 | Hono: Arbitrary file access via serveStatic vulnerability | 7.5 | |
| High | CVE-2024-32652 | @hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed | 7.5 | |
| High | CVE-2026-39408 | Hono has a path traversal in toSSG() allows writing files outside the output directory | 7.5 | |
| High | CVE-2025-58362 | Hono contains a flaw in URL path parsing, potentially leading to path confusion | 7.5 | |
| Medium | CVE-2026-56762 | Hono - Missing Cookie Name Validation in setCookie() | 5.3 | |
| High | CVE-2025-62610 | Hono Improperly Authorizes JWT Audience Validation | 8.1 | |
| Medium | CVE-2026-24473 | Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter) | 5.3 | |
| High | CVE-2026-27700 | Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo | 8.2 | |
| High | CVE-2026-29087 | Honojs Node-server: Incorrect Authorization | 7.5 | |
| Medium | CVE-2025-71381 | Hono - Vary Header Injection in CORS Middleware | 6.5 | |
| Medium | CVE-2026-59896 | hono/jsx does not isolate context per request, leading to cross-request data disclosure | 6.5 | |
| Medium | CVE-2026-56764 | Hono - Timing Attack in basicAuth and bearerAuth Middleware | 3.7 | |
| Medium | CVE-2026-59895 | Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility | 6.1 | |
| Medium | CVE-2026-24472 | Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception | 5.3 | |
| Medium | CVE-2026-39407 | Hono has a middleware bypass via repeated slashes in serveStatic | 5.3 | |
| Medium | CVE-2026-56763 | Hono - Prototype Pollution via __proto__ Key in parseBody with dot Option | 4.8 | |
| High | CVE-2026-22817 | Hono: Improper Verification of Cryptographic Signature | 8.2 | |
| High | CVE-2026-22818 | Hono: Improper Verification of Cryptographic Signature | 8.2 | |
| Medium | CVE-2024-23340 | @hono/node-server can't handle "double dots" in URL | 5.3 | |
| Medium | CVE-2026-39409 | Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses | 5.3 | |
| Medium | CVE-2024-32869 | Hono vulnerable to Restricted Directory Traversal in serveStatic with deno | 5.3 | |
| Medium | CVE-2026-44456 | Hono: bodyLimit() can be bypassed for chunked / unknown-length requests | 6.5 | |
| Medium | CVE-2026-29085 | Hono: SSE Control Field Injection via CR/LF in writeSSE() | 6.5 | |
| Medium | CVE-2026-39406 | @hono/node-server has a middleware bypass via repeated slashes in serveStatic | 5.3 | |
| Medium | CVE-2026-56761 | hono - HTML Injection via Improper JSX Attribute Name Handling in SSR | 4.3 |
Products
| Hono | 38 | 0 |
| Node-server | 4 | 0 |