Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how hono compares to other vendors in security performance

View Risk Score →

Hono HonoHono: Proxy Helper does not remove response headers listed in the `Connection` header

Risk 20
Severity
3.7
First published (updated )
CVE-2026-71849

Hono HonoHono - Prototype Pollution via __proto__ Key in parseBody with dot Option

Risk 35
Severity
6.3
First published (updated )
CVE-2026-56763

Hono Web application frameworkHono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

Risk 38
Severity
6.1
First published (updated )
CVE-2026-59895

npm/hono/jsxhono/jsx does not isolate context per request, leading to cross-request data disclosure

Risk 45
Severity
6.5
First published (updated )
CVE-2026-59896

HonoHono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

Risk 27
Severity
5.3
First published (updated )
CVE-2026-59897
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Hono HonoHono - Vary Header Injection in CORS Middleware

Risk 41
Severity
6.9
First published (updated )
CVE-2025-71381

npm/honohono - HTML Injection via Improper JSX Attribute Name Handling in SSR

Risk 26
Severity
5.3
First published (updated )
CVE-2026-56761

npm/honoHono: JWT middleware accepts any Authorization scheme, not only Bearer

Risk 40
Severity
6.5
First published (updated )
CVE-2026-47673

npm/honoHono: IP Restriction bypasses static deny rules for non-canonical IPv6

Risk 27
Severity
5.3
First published (updated )
CVE-2026-47674

npm/honoHono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Risk 27
Severity
5.3
First published (updated )
CVE-2026-47675
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

npm/honoHono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Risk 27
Severity
5.3
First published (updated )
CVE-2026-47676

npm/honoHono: CSS Declaration Injection via Style Object Values in JSX SSR

Risk 22
Severity
4.3
First published (updated )
CVE-2026-44458

npm/honoHono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

Risk 26
Severity
3.8
First published (updated )
CVE-2026-44459

npm/honoHono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

Risk 27
Severity
5.3
First published (updated )
CVE-2026-44457

npm/honoHono: bodyLimit() can be bypassed for chunked / unknown-length requests

Risk 40
Severity
6.5
First published (updated )
CVE-2026-44456
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

npm/honoHono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection

Risk 38
Severity
6.1
First published (updated )
CVE-2026-44455

npm/honoHono has a non-breaking space prefix bypass in cookie name handling in getCookie()

Risk 32
Severity
4.8
First published (updated )
CVE-2026-39410

npm/honoHono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

Risk 29
Severity
6.3
First published (updated )
CVE-2026-39409

npm/honoHono has a path traversal in toSSG() allows writing files outside the output directory

Risk 43
Severity
5.9
First published (updated )
CVE-2026-39408

npm/honoHono has a middleware bypass via repeated slashes in serveStatic

Risk 27
Severity
5.3
First published (updated )
CVE-2026-39407
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

npm/@hono/node-server@hono/node-server has a middleware bypass via repeated slashes in serveStatic

Risk 27
Severity
5.3
First published (updated )
CVE-2026-39406

npm/@hono/node-server@hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

Risk 31
Severity
7.5
EPSS
0.04%
First published (updated )
CVE-2026-29087

npm/honoHono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()

Risk 24
Severity
5.4
EPSS
0.03%
First published (updated )
CVE-2026-29086

npm/honoHono: SSE Control Field Injection via CR/LF in writeSSE()

Risk 28
Severity
6.5
EPSS
0.05%
First published (updated )
CVE-2026-29085

npm/honoHono: Arbitrary file access via serveStatic vulnerability

Risk 61
Severity
9.8
EPSS
0.04%
First published (updated )
CVE-2026-29045
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

npm/honoHono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo

Risk 38
Severity
8.2
EPSS
0.02%
First published (updated )
CVE-2026-27700

npm/honoHono has a Cross-site Scripting vulnerability

Risk 23
Severity
4.7
EPSS
0.04%
First published (updated )
CVE-2026-24771

npm/honoHono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)

Risk 21
Severity
6.3
EPSS
0.01%
First published (updated )
CVE-2026-24473

npm/honoHono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception

Risk 19
Severity
5.3
EPSS
0.01%
First published (updated )
CVE-2026-24472

npm/honoHono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing

Risk 28
Severity
6.5
EPSS
0.01%
First published (updated )
CVE-2026-24398
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203