CVE-2026-56764 | Low | 3.7 | 2026-07-15 | Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timing… |
CVE-2026-56763 | Medium | 4.8 | 2026-07-11 | Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ pr… |
CVE-2026-59897 | Medium | 4.8 | 2026-07-08 | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a dist… |
CVE-2026-59896 | Medium | 6.5 | 2026-07-08 | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per r… |
CVE-2026-59895 | Medium | 6.1 | 2026-07-08 | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in hono/css composes class names from pla… |
CVE-2025-71381 | Medium | 6.5 | 2026-06-30 | Hono before 4.10.2 (fixed in 4.10.3) contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the… |
CVE-2026-56761 | Medium | 4.3 | 2026-06-24 | hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed at… |
CVE-2026-56762 | Medium | 5.3 | 2026-06-23 | Hono before 4.12.12 does not validate cookie names on the write path in the setCookie(), serialize(), and serializeSigned() functions, allowing invalid charact… |
CVE-2026-47676 | Medium | 5.3 | 2026-05-28 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming r… |
CVE-2026-47675 | Medium | 4.3 | 2026-05-28 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domai… |
CVE-2026-47674 | Medium | 5.3 | 2026-05-28 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) com… |
CVE-2026-47673 | Medium | 4.8 | 2026-05-28 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Auth… |
CVE-2026-44459 | Low | 3.8 | 2026-05-13 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp… |
CVE-2026-44458 | Medium | 4.3 | 2026-05-13 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values… |
CVE-2026-44457 | Medium | 5.3 | 2026-05-13 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses th… |
CVE-2026-44456 | Medium | 6.5 | 2026-05-13 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for reque… |
CVE-2026-44455 | Medium | 4.7 | 2026-05-13 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx… |
CVE-2026-39410 | Medium | 4.8 | 2026-04-08 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a discrepancy between browser cookie parsing and parse(… |
CVE-2026-39409 | Medium | 5.3 | 2026-04-08 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, ipRestriction() does not canonicalize IPv4-mapped IPv6… |
CVE-2026-39408 | High | 7.5 | 2026-04-08 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be wr… |
CVE-2026-39407 | Medium | 5.3 | 2026-04-08 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path handling inconsistency in serveStatic allows pro… |
CVE-2026-39406 | Medium | 5.3 | 2026-04-08 | @hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files… |
CVE-2026-29087 | High | 7.5 | 2026-03-06 | @hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with ro… |
CVE-2026-29086 | Medium | 5.4 | 2026-03-04 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie() utility did not validate semicol… |
CVE-2026-29085 | Medium | 6.5 | 2026-03-04 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using streamSSE() in Streaming Helper, the… |
CVE-2026-29045 | High | 7.5 | 2026-03-04 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based… |
CVE-2026-27700 | High | 8.2 | 2026-02-25 | Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter (`hono/a… |
CVE-2026-24771 | Medium | 4.7 | 2026-01-27 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, a Cross-Site Scripting (XSS) vulnerability exist… |
CVE-2026-24473 | Medium | 5.3 | 2026-01-27 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Serve static Middleware for the Cloudflare Worke… |
CVE-2026-24472 | Medium | 5.3 | 2026-01-27 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Middleware contains an information disclos… |
CVE-2026-24398 | Medium | 4.8 | 2026-01-27 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, IP Restriction Middleware in Hono is vulnerable… |
CVE-2026-22818 | High | 8.2 | 2026-01-13 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification midd… |
CVE-2026-22817 | High | 8.2 | 2026-01-13 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification midd… |
CVE-2025-62610 | High | 8.1 | 2025-10-22 | Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middleware does… |
CVE-2025-59139 | Medium | 5.3 | 2025-09-12 | Hono is a Web application framework that provides support for any JavaScript runtime. In versions prior to 4.9.7, a flaw in the `bodyLimit` middleware could al… |
CVE-2025-58362 | High | 7.5 | 2025-09-05 | Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility functi… |
CVE-2024-48913 | Medium | 5.9 | 2024-10-15 | Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery (CSRF) middleware by a request without Content-Type header… |
CVE-2024-43787 | Medium | 5.0 | 2024-08-22 | Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. M… |
CVE-2024-32869 | Medium | 5.3 | 2024-04-23 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.2.7, when using serveStatic with deno, it is possible… |
CVE-2024-32652 | High | 7.5 | 2024-04-19 | The adapter @hono/node-server allows you to run your Hono application on Node.js. Prior to 1.10.1, the application hangs when receiving a Host header with a va… |
CVE-2024-23340 | Medium | 5.3 | 2024-01-22 | @hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with `ur… |
CVE-2023-50710 | Medium | 4.2 | 2023-12-14 | Hono is a web framework written in TypeScript. Prior to version 3.11.7, clients may override named path parameter values from previous requests if the applicat… |