hono

Top products

The 15 most recently published vulnerabilities affecting hono.

• CVE-2026-56764Hono - Timing Attack in basicAuth and bearerAuth Middleware3.7Jul 15, 2026
• CVE-2026-56763Hono - Prototype Pollution via __proto__ Key in parseBody with dot Option4.8Jul 11, 2026
• CVE-2026-59895Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility6.1Jul 8, 2026
• CVE-2026-59896hono/jsx does not isolate context per request, leading to cross-request data disclosure6.5Jul 8, 2026
• CVE-2026-59897Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication4.8Jul 8, 2026
• CVE-2025-71381Hono - Vary Header Injection in CORS Middleware6.5Jun 30, 2026
• CVE-2026-56761hono - HTML Injection via Improper JSX Attribute Name Handling in SSR4.3Jun 24, 2026
• CVE-2026-56762Hono - Missing Cookie Name Validation in setCookie()5.3Jun 23, 2026
• CVE-2026-47673Hono: JWT middleware accepts any Authorization scheme, not only Bearer4.8May 28, 2026
• CVE-2026-47674Hono: IP Restriction bypasses static deny rules for non-canonical IPv65.3May 28, 2026
• CVE-2026-47675Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection4.3May 28, 2026
• CVE-2026-47676Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths5.3May 28, 2026
• CVE-2026-44459Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()3.8May 13, 2026
• CVE-2026-44458Hono: CSS Declaration Injection via Style Object Values in JSX SSR4.3May 13, 2026
• CVE-2026-44457Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage5.3May 13, 2026