Product by Honojs
Hono
48 known vulnerabilities in Hono (Honojs), 0 of them actively exploited (CISA KEV).
Key figures
48
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Medium | CVE-2026-109955 | Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding | 5.3 | |
| Medium | CVE-2026-84365 | Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory | 6.5 | |
| Critical | CVE-2026-29045 | Hono: Arbitrary file access via serveStatic vulnerability | 7.5 | |
| Medium | CVE-2026-69207 | Hono: ReDoS in CORS middleware via Access-Control-Request-Headers | 5.3 | |
| High | CVE-2026-39408 | Hono has a path traversal in toSSG() allows writing files outside the output directory | 7.5 | |
| Medium | CVE-2026-84364 | Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion | 5.3 | |
| Medium | CVE-2026-84363 | Hono: HTTP Request/Response Smuggling | 5.9 | |
| High | CVE-2025-58362 | Hono contains a flaw in URL path parsing, potentially leading to path confusion | 7.5 | |
| Medium | CVE-2026-71848 | Hono: Algorithmic Complexity DoS in Language Middleware | 5.3 | |
| Medium | CVE-2026-111757 | Hono: Double Decoding of the Same Data | 5.3 | |
| High | CVE-2025-62610 | Hono Improperly Authorizes JWT Audience Validation | 8.1 | |
| High | CVE-2026-54290 | Hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard | 7.1 | |
| Medium | CVE-2026-54286 | Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) | 5.9 | |
| Medium | CVE-2026-24473 | Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter) | 5.3 | |
| High | CVE-2026-27700 | Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo | 8.2 | |
| Medium | CVE-2026-59896 | hono/jsx does not isolate context per request, leading to cross-request data disclosure | 6.5 | |
| Medium | CVE-2026-59895 | Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility | 6.1 | |
| Medium | CVE-2026-24472 | Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception | 5.3 | |
| Medium | CVE-2026-39407 | Hono has a middleware bypass via repeated slashes in serveStatic | 5.3 | |
| High | CVE-2026-22817 | Hono: Improper Verification of Cryptographic Signature | 8.2 | |
| High | CVE-2026-22818 | Hono: Improper Verification of Cryptographic Signature | 8.2 | |
| Medium | CVE-2026-39409 | Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses | 5.3 | |
| Medium | CVE-2026-93981 | hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings | 4.7 | |
| Medium | CVE-2024-32869 | Hono vulnerable to Restricted Directory Traversal in serveStatic with deno | 5.3 | |
| Medium | CVE-2026-54288 | Hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length` | 6.5 |