Vulnerabilities in honojs
55 resultsCVE-2026-24771MEDIUMHono has a Cross-site Scripting vulnerabilityEPSS 0.4%CVE-2026-29087HIGH@hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static MiddlewareEPSS 0.4%CVE-2026-71849LOWHono: Proxy Helper does not remove response headers listed in the `Connection` headerEPSS 0.4%CVE-2026-118663MEDIUM@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathsEPSS 0.4%CVE-2026-39409MEDIUMHono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addressesEPSS 0.3%CVE-2026-24398MEDIUMHono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofingEPSS 0.3%CVE-2026-54290HIGHHono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcardEPSS 0.3%CVE-2026-59895MEDIUMHono: Server-Side XSS via JSX Escaping Bypass in cx() UtilityEPSS 0.3%CVE-2024-48913MEDIUMHono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.EPSS 0.3%CVE-2026-109955MEDIUMHono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double DecodingEPSS 0.3%CVE-2026-54287MEDIUMHono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and LatticeEPSS 0.3%CVE-2026-111757MEDIUMHono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathsEPSS 0.3%CVE-2026-59896MEDIUMhono/jsx does not isolate context per request, leading to cross-request data disclosureEPSS 0.3%CVE-2026-39410MEDIUMHono has a non-breaking space prefix bypass in cookie name handling in getCookie()EPSS 0.3%CVE-2026-29085MEDIUMHono: SSE Control Field Injection via CR/LF in writeSSE()EPSS 0.3%CVE-2026-27700HIGHHono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfoEPSS 0.3%CVE-2026-71850MEDIUMHono: `memo()` retains SSR output across requests, leading to cross-user data disclosureEPSS 0.3%CVE-2026-47676MEDIUMHono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded pathsEPSS 0.3%CVE-2026-29086MEDIUMHono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()EPSS 0.3%CVE-2026-47674MEDIUMHono: IP Restriction bypasses static deny rules for non-canonical IPv6EPSS 0.2%