Vendor
Honojs
55 known vulnerabilities in products by Honojs, 0 of them actively exploited (CISA KEV).
Key figures
55
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-29045 | Hono: Arbitrary file access via serveStatic vulnerability | 7.5 | |
| High | CVE-2024-32652 | @hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed | 7.5 | |
| Medium | CVE-2026-109955 | Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding | 5.3 | |
| Medium | CVE-2026-84365 | Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory | 6.5 | |
| Medium | CVE-2026-69207 | Hono: ReDoS in CORS middleware via Access-Control-Request-Headers | 5.3 | |
| High | CVE-2026-39408 | Hono has a path traversal in toSSG() allows writing files outside the output directory | 7.5 | |
| Medium | CVE-2026-84364 | Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion | 5.3 | |
| Medium | CVE-2026-84363 | Hono: HTTP Request/Response Smuggling | 5.9 | |
| Medium | CVE-2026-73565 | @hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake | 5.3 | |
| High | CVE-2025-58362 | Hono contains a flaw in URL path parsing, potentially leading to path confusion | 7.5 | |
| Medium | CVE-2026-71848 | Hono: Algorithmic Complexity DoS in Language Middleware | 5.3 | |
| Medium | CVE-2026-118663 | Honojs Node-server: Double Decoding of the Same Data | 5.3 | |
| Medium | CVE-2026-111757 | Hono: Double Decoding of the Same Data | 5.3 | |
| High | CVE-2025-62610 | Hono Improperly Authorizes JWT Audience Validation | 8.1 | |
| High | CVE-2026-54290 | Hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard | 7.1 | |
| Medium | CVE-2026-54286 | Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) | 5.9 | |
| Medium | CVE-2026-24473 | Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter) | 5.3 | |
| High | CVE-2026-27700 | Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo | 8.2 | |
| High | CVE-2026-29087 | Honojs Node-server: Incorrect Authorization | 7.5 | |
| Medium | CVE-2026-59896 | hono/jsx does not isolate context per request, leading to cross-request data disclosure | 6.5 | |
| Medium | CVE-2026-59895 | Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility | 6.1 | |
| Medium | CVE-2026-24472 | Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception | 5.3 | |
| Medium | CVE-2026-39407 | Hono has a middleware bypass via repeated slashes in serveStatic | 5.3 | |
| High | CVE-2026-22817 | Hono: Improper Verification of Cryptographic Signature | 8.2 | |
| High | CVE-2026-22818 | Hono: Improper Verification of Cryptographic Signature | 8.2 |
Products
| Hono | 48 | 0 |
| Node-server | 6 | 0 |