honojs hono

• CVE-2026-111757 Medium 5.3 Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths 0.3%
• CVE-2026-109955 Medium 5.3 Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding 0.3%
• CVE-2026-93981 Medium 4.7 hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings 0.2%
• CVE-2026-84365 Medium 6.5 Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory 0.4%
• CVE-2026-84364 Medium 5.3 Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion 0.5%
• CVE-2026-84363 Medium 5.9 Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials 0.4%
• CVE-2026-69207 Medium 5.3 Hono: ReDoS in CORS middleware via Access-Control-Request-Headers 0.6%
• CVE-2026-71850 Medium 4.8 Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure 0.3%
• CVE-2026-71849 Low 3.7 Hono: Proxy Helper does not remove response headers listed in the `Connection` header 0.4%
• CVE-2026-71848 Medium 5.3 Hono: Algorithmic Complexity DoS in Language Middleware 0.5%
• CVE-2026-59895 Medium 6.1 Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility 0.3%
• CVE-2026-59896 Medium 6.5 hono/jsx does not isolate context per request, leading to cross-request data disclosure 0.3%
• CVE-2026-59897 Medium 4.8 Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication 0.2%
• CVE-2026-54288 Medium 6.5 Hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length` 0.1%
• CVE-2026-54289 Medium 4.8 Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest 0.2%
• CVE-2026-54290 High 7.1 Hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard 0.3%
• CVE-2026-54286 Medium 5.9 Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) 0.4%
• CVE-2026-54287 Medium 5.3 Hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice 0.3%
• CVE-2026-47673 Medium 4.8 Hono: JWT middleware accepts any Authorization scheme, not only Bearer 0.2%
• CVE-2026-47674 Medium 5.3 Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 0.2%
• CVE-2026-47675 Medium 4.3 Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection 0.2%
• CVE-2026-47676 Medium 5.3 Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths 0.3%
• CVE-2026-44459 Low 3.8 Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify() 0.2%
• CVE-2026-44458 Medium 4.3 Hono: CSS Declaration Injection via Style Object Values in JSX SSR 0.2%
• CVE-2026-44457 Medium 5.3 Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage 0.2%
• CVE-2026-44456 Medium 6.5 Hono: bodyLimit() can be bypassed for chunked / unknown-length requests 0.2%
• CVE-2026-44455 Medium 4.7 Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection 0.1%
• CVE-2026-39410 Medium 4.8 Hono has a non-breaking space prefix bypass in cookie name handling in getCookie() 0.3%
• CVE-2026-39409 Medium 6.3 Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses 0.3%
• CVE-2026-39408 High 7.5 Hono has a path traversal in toSSG() allows writing files outside the output directory 0.5%
• CVE-2026-39407 Medium 5.3 Hono has a middleware bypass via repeated slashes in serveStatic 0.5%
• CVE-2026-29085 Medium 6.5 Hono: SSE Control Field Injection via CR/LF in writeSSE() 0.3%
• CVE-2026-29045 High 7.5 Hono: Arbitrary file access via serveStatic vulnerability 0.6%
• CVE-2026-29086 Medium 5.4 Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie() 0.3%
• CVE-2026-27700 High 8.2 Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo 0.3%
• CVE-2026-24771 Medium 4.7 Hono has a Cross-site Scripting vulnerability 0.4%
• CVE-2026-24473 Medium 6.3 Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter) 0.5%
• CVE-2026-24472 Medium 5.3 Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception 0.5%
• CVE-2026-24398 Medium 4.8 Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing 0.3%
• CVE-2026-22817 High 8.2 JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass 0.2%
• CVE-2026-22818 High 8.2 JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback) 0.1%
• CVE-2025-62610 High 8.1 Hono Improperly Authorizes JWT Audience Validation 0.4%
• CVE-2025-59139 Medium 5.3 Hono has Body Limit Middleware Bypass 0.4%
• CVE-2025-58362 High 7.5 Hono contains a flaw in URL path parsing, potentially leading to path confusion 0.6%
• CVE-2024-48913 Medium 5.9 Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header. 0.3%
• CVE-2024-43787 Medium 5.0 Hono CSRF middleware can be bypassed using crafted Content-Type header 0.2%
• CVE-2024-32869 Medium 5.3 Hono vulnerable to Restricted Directory Traversal in serveStatic with deno 0.6%
• CVE-2023-50710 Medium 4.2 Hono's named path parameters can be overridden in TrieRouter 0.6%