honojs hono
48 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-111757 | >= 4.12.4, < 4.13.11 | Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-109955 | 4.12.4 – < 4.13.11 | Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-93981 | < 4.13.7 | hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings | LOW 2.3 | 0.2 % | ||
| CVE-2026-84365 | < 4.13.5 | Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-84364 | < 4.13.5 | Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-84363 | < 4.13.5 | Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-69207 | < 4.12.34 | Hono: ReDoS in CORS middleware via Access-Control-Request-Headers | MEDIUM 5.3 | 0.6 % | ||
| CVE-2026-71850 | >= 3.8.0, < 4.12.34 | Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure | MEDIUM 4.8 | 0.3 % | ||
| CVE-2026-71849 | >= 4.7.0, < 4.12.34 | Hono: Proxy Helper does not remove response headers listed in the `Connection` header | LOW 3.7 | 0.4 % | ||
| CVE-2026-71848 | >= 4.12.0, < 4.12.34 | Hono: Algorithmic Complexity DoS in Language Middleware | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-59895 | >= 4.0.0, < 4.12.27 | Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-59896 | >= 4.11.8, < 4.12.27 | hono/jsx does not isolate context per request, leading to cross-request data disclosure | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-59897 | >= 4.3.3, < 4.12.27 | Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-54288 | < 4.12.25 | Hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length` | MEDIUM 6.5 | 0.1 % | ||
| CVE-2026-54289 | < 4.12.25 | Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest | MEDIUM 4.8 | 0.2 % | ||
| CVE-2026-54290 | < 4.12.25 | Hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard | HIGH 7.1 | 0.3 % | ||
| CVE-2026-54286 | < 4.12.25 | Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-54287 | < 4.12.25 | Hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-47673 | < 4.12.21 | Hono: JWT middleware accepts any Authorization scheme, not only Bearer | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-47674 | < 4.12.21 | Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-47675 | < 4.12.21 | Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-47676 | < 4.12.21 | Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-44459 | < 4.12.18 | Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify() | LOW 3.8 | 0.2 % | ||
| CVE-2026-44458 | < 4.12.18 | Hono: CSS Declaration Injection via Style Object Values in JSX SSR | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-44457 | < 4.12.18 | Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-44456 | < 4.12.16 | Hono: bodyLimit() can be bypassed for chunked / unknown-length requests | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-44455 | < 4.12.16 | Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-39410 | < 4.12.12 | Hono has a non-breaking space prefix bypass in cookie name handling in getCookie() | MEDIUM 4.8 | 0.3 % | ||
| CVE-2026-39409 | < 4.12.12 | Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-39408 | < 4.12.12 | Hono has a path traversal in toSSG() allows writing files outside the output directory | MEDIUM 5.9 | 0.5 % | ||
| CVE-2026-39407 | < 4.12.12 | Hono has a middleware bypass via repeated slashes in serveStatic | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-29085 | < 4.12.4 | Hono: SSE Control Field Injection via CR/LF in writeSSE() | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-29045 | < 4.12.4 | Hono: Arbitrary file access via serveStatic vulnerability | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-29086 | < 4.12.4 | Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie() | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-27700 | >= 4.12.0, < 4.12.2 | Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo | HIGH 8.2 | 0.3 % | ||
| CVE-2026-24771 | < 4.11.7 | Hono has a Cross-site Scripting vulnerability | MEDIUM 4.7 | 0.4 % | ||
| CVE-2026-24473 | < 4.11.7 | Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter) | MEDIUM 6.3 | 0.5 % | ||
| CVE-2026-24472 | < 4.11.7 | Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-24398 | < 4.11.7 | Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-22817 | < 4.11.4 | JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass | HIGH 8.2 | 0.2 % | ||
| CVE-2026-22818 | < 4.11.4 | JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback) | HIGH 8.2 | 0.1 % | ||
| CVE-2025-62610 | >= 1.1.0, < 4.10.2 | Hono Improperly Authorizes JWT Audience Validation | HIGH 8.1 | 0.4 % | ||
| CVE-2025-59139 | < 4.9.7 | Hono has Body Limit Middleware Bypass | MEDIUM 5.3 | 0.4 % | ||
| CVE-2025-58362 | >= 4.8.0, < 4.9.6 | Hono contains a flaw in URL path parsing, potentially leading to path confusion | HIGH 7.5 | 0.6 % | ||
| CVE-2024-48913 | < 4.6.5 | Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header. | MEDIUM 5.9 | 0.3 % | ||
| CVE-2024-43787 | < 4.5.8 | Hono CSRF middleware can be bypassed using crafted Content-Type header | MEDIUM 5.0 | 0.2 % | ||
| CVE-2024-32869 | < 4.2.7 | Hono vulnerable to Restricted Directory Traversal in serveStatic with deno | MEDIUM 5.3 | 0.6 % | ||
| CVE-2023-50710 | < 3.11.7 | Hono's named path parameters can be overridden in TrieRouter | MEDIUM 4.3 | 0.6 % |