hono (npm)
Advisories
56
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 4.13.11 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install hono@4.13.11yarn
yarn add hono@4.13.11pnpm
pnpm add hono@4.13.11Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-5r4p-p66f-jhc7 Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths |
Medium EPSS 0.32% |
>= 4.12.4, < 4.13.11 | 4.13.11 |
| GHSA-6623-4q32-82v8 Duplicate Advisory: hono/jsx renders plain strings unescaped in boundary components, leading to XSS Withdrawn |
Medium | all versions | No fix yet |
| GHSA-hxh3-vqpv-xpqv hono/jsx renders plain strings unescaped in boundary components, leading to XSS |
Low EPSS 0.23% |
< 4.13.7 | 4.13.7 |
| GHSA-gqvv-2mrq-wpjv Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory |
Medium EPSS 0.44% |
< 4.13.5 | 4.13.5 |
| GHSA-g6gw-c38x-mqfc Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion |
Medium EPSS 0.53% |
< 4.13.5 | 4.13.5 |
| GHSA-crvj-82cr-hjcx Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials |
Medium EPSS 0.45% |
< 4.13.5 | 4.13.5 |
| GHSA-f23p-vx2j-j53r Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure |
Medium EPSS 0.27% |
>= 3.8.0, < 4.12.34 | 4.12.34 |
| GHSA-79qm-7rj5-m7r9 Hono: Proxy Helper does not remove response headers listed in the `Connection` header |
Low EPSS 0.36% |
>= 4.7.0, < 4.12.34 | 4.12.34 |
| GHSA-54fx-42gc-7vw4 Hono: Algorithmic Complexity DoS in Language Middleware |
Medium EPSS 0.51% |
>= 4.12.0, < 4.12.34 | 4.12.34 |
| GHSA-8j4g-w8fx-2239 Hono: ReDoS in CORS middleware via Access-Control-Request-Headers |
Medium EPSS 0.61% |
< 4.12.34 | 4.12.34 |
| GHSA-3wcj-gjvf-fvch Duplicate Advisory: Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true }) Withdrawn |
Medium | all versions | No fix yet |
| GHSA-xgm2-5f3f-mvvc Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication |
Medium EPSS 0.18% |
>= 4.3.3, < 4.12.27 | 4.12.27 |
| GHSA-hvrm-45r6-mjfj hono/jsx does not isolate context per request, leading to cross-request data disclosure |
Medium EPSS 0.30% |
>= 4.11.8, < 4.12.27 | 4.12.27 |
| GHSA-w62v-xxxg-mg59 Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility |
Medium EPSS 0.33% |
>= 4.0.0, < 4.12.27 | 4.12.27 |
| GHSA-cw3j-28qq-x3xh Duplicate Advisory: Hono vulnerable to Vary Header Injection leading to potential CORS Bypass Withdrawn |
Medium | all versions | No fix yet |
| GHSA-55cm-p4ww-685g Duplicate Advisory: Hono missing validation of cookie name on write path in setCookie() Withdrawn |
Medium | < 4.12.12 | 4.12.12 |
| GHSA-rv63-4mwf-qqc2 hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length` |
Medium EPSS 0.15% |
< 4.12.25 | 4.12.25 |
| GHSA-wgpf-jwqj-8h8p hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest |
Medium EPSS 0.18% |
< 4.12.25 | 4.12.25 |
| GHSA-88fw-hqm2-52qc hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard |
High EPSS 0.33% |
< 4.12.25 | 4.12.25 |
| GHSA-wwfh-h76j-fc44 hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) |
Medium EPSS 0.43% |
< 4.12.25 | 4.12.25 |
| GHSA-j6c9-x7qj-28xf hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice |
Medium EPSS 0.31% |
< 4.12.25 | 4.12.25 |
| GHSA-2gcr-mfcq-wcc3 Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths |
Medium EPSS 0.26% |
< 4.12.21 | 4.12.21 |
| GHSA-3hrh-pfw6-9m5x Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection |
Medium EPSS 0.22% |
< 4.12.21 | 4.12.21 |
| GHSA-xrhx-7g5j-rcj5 Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 |
Medium EPSS 0.24% |
< 4.12.21 | 4.12.21 |
| GHSA-f577-qrjj-4474 Hono: JWT middleware accepts any Authorization scheme, not only Bearer |
Medium EPSS 0.20% |
< 4.12.21 | 4.12.21 |
| GHSA-qp7p-654g-cw7p Hono has CSS Declaration Injection via Style Object Values in JSX SSR |
Medium EPSS 0.20% |
< 4.12.18 | 4.12.18 |
| GHSA-hm8q-7f3q-5f36 Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify() |
Low EPSS 0.22% |
< 4.12.18 | 4.12.18 |
| GHSA-p77w-8qqv-26rm Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage |
Medium EPSS 0.20% |
< 4.12.18 | 4.12.18 |
| GHSA-9vqf-7f2p-gf9v Hono: bodyLimit() can be bypassed for chunked / unknown-length requests |
Medium EPSS 0.22% |
< 4.12.16 | 4.12.16 |
| GHSA-69xw-7hcm-h432 hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection |
Medium EPSS 0.14% |
< 4.12.16 | 4.12.16 |
| GHSA-458j-xx4x-4375 hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR |
Medium EPSS 0.29% |
< 4.12.14 | 4.12.14 |
| GHSA-r5rp-j6wh-rvv4 Hono: Non-breaking space prefix bypass in cookie name handling in getCookie() |
Medium EPSS 0.28% |
< 4.12.12 | 4.12.12 |
| GHSA-xpcf-pg52-r92g Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses |
Medium EPSS 0.34% |
< 4.12.12 | 4.12.12 |
| GHSA-26pp-8wgv-hjvm Hono missing validation of cookie name on write path in setCookie() |
Medium EPSS 0.42% |
< 4.12.12 | 4.12.12 |
| GHSA-xf4j-xp2r-rqqx Hono: Path traversal in toSSG() allows writing files outside the output directory |
High EPSS 0.50% |
>= 4.0.0, < 4.12.12 | 4.12.12 |
| GHSA-wmmm-f939-6g9c Hono: Middleware bypass via repeated slashes in serveStatic |
Medium EPSS 0.46% |
< 4.12.12 | 4.12.12 |
| GHSA-v8w9-8mx6-g223 Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true }) |
Medium EPSS 0.27% |
< 4.12.7 | 4.12.7 |
| GHSA-5pq2-9x2x-5p6w Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie() |
Medium EPSS 0.26% |
< 4.12.4 | 4.12.4 |
| GHSA-p6xx-57qc-3wxr Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE() |
Medium EPSS 0.28% |
< 4.12.4 | 4.12.4 |
| GHSA-q5qw-h33p-qvwr Hono vulnerable to arbitrary file access via serveStatic vulnerability |
Critical EPSS 0.59% |
< 4.12.4 | 4.12.4 |
| GHSA-xh87-mx6m-69f3 Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo |
High EPSS 0.27% |
>= 4.12.0, < 4.12.2 | 4.12.2 |
| GHSA-gq3j-xvxp-8hrf Hono added timing comparison hardening in basicAuth and bearerAuth |
Medium EPSS 0.30% |
< 4.11.10 | 4.11.10 |
| GHSA-9r54-q6cx-xmh5 Hono vulnerable to XSS through ErrorBoundary component |
Medium EPSS 0.37% |
< 4.11.7 | 4.11.7 |
| GHSA-w332-q679-j88p Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter) |
Medium EPSS 0.48% |
< 4.11.7 | 4.11.7 |
| GHSA-6wqw-2p9w-4vw4 Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception |
Medium EPSS 0.52% |
< 4.11.7 | 4.11.7 |
| GHSA-r354-f388-2fhh Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing |
Medium EPSS 0.34% |
< 4.11.7 | 4.11.7 |
| GHSA-3vhc-576x-3qv4 Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback) |
Medium EPSS 0.14% |
< 4.11.4 | 4.11.4 |
| GHSA-f67f-6cw9-8mq4 Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass |
Medium EPSS 0.17% |
< 4.11.4 | 4.11.4 |
| GHSA-q7jf-gf43-6x6p Hono vulnerable to Vary Header Injection leading to potential CORS Bypass |
Medium EPSS 0.29% |
< 4.10.3 | 4.10.3 |
| GHSA-m732-5p4w-x69g Hono Improper Authorization vulnerability |
High EPSS 0.38% |
>= 1.1.0, < 4.10.2 | 4.10.2 |
| GHSA-92vj-g62v-jqhh Hono has Body Limit Middleware Bypass |
Medium EPSS 0.45% |
< 4.9.7 | 4.9.7 |
| GHSA-9hp6-4448-45g2 Hono's flaw in URL path parsing could cause path confusion |
High EPSS 0.55% |
>= 4.8.0, < 4.9.6 | 4.9.6 |
| GHSA-2234-fmw7-43wr Hono allows bypass of CSRF Middleware by a request without Content-Type header. |
Medium EPSS 0.33% |
< 4.6.5 | 4.6.5 |
| GHSA-rpfr-3m35-5vx5 Hono CSRF middleware can be bypassed using crafted Content-Type header |
Medium EPSS 0.24% |
< 4.5.8 | 4.5.8 |
| GHSA-3mpf-rcc7-5347 Hono vulnerable to Restricted Directory Traversal in serveStatic with deno |
Medium EPSS 0.64% |
< 4.2.7 | 4.2.7 |
| GHSA-f6gv-hh8j-q8vq Named path parameters can be overridden in TrieRouter |
Medium EPSS 0.64% |
< 3.11.7 | 3.11.7 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor