Exposição de Hono
Web frameworks24
score de exposição
72
sites usam
0
em exploração
0
críticos
Análise Vexday
Hono acumula 38 CVEs catalogadas, com nenhuma em exploração ativa confirmada pelo CISA KEV, taxa que se situa abaixo da média geral do catálogo. O dado que merece atenção imediata é a concentração de 21 vulnerabilidades surgidas nos últimos 90 dias, indicando um ritmo recente de descobertas elevado para o período. O tipo de falha mais recorrente é CWE-22 (Path Traversal), padrão que tipicamente permite a um atacante acessar arquivos fora do diretório pretendido pela aplicação, e a CVE mais perigosa ativa no momento, CVE-2024-32869, apresenta EPSS de 0,0064 — probabilidade de exploração ainda baixa, mas que deve ser monitorada dado o volume recente de novas entradas.
CVEs
52 resultadosCVE-2024-32869MEDIUMHono vulnerable to Restricted Directory Traversal in serveStatic with denoEPSS 0.6%CVE-2023-50710MEDIUMHono's named path parameters can be overridden in TrieRouterEPSS 0.6%CVE-2025-58362HIGHHono contains a flaw in URL path parsing, potentially leading to path confusionEPSS 0.5%CVE-2026-39408MEDIUMHono has a path traversal in toSSG() allows writing files outside the output directoryEPSS 0.5%CVE-2026-29045HIGHHono: Arbitrary file access via serveStatic vulnerabilityEPSS 0.5%CVE-2026-69207MEDIUMHono: ReDoS in CORS middleware via Access-Control-Request-HeadersEPSS 0.5%CVE-2026-24472MEDIUMHono cache middleware ignores "Cache-Control: private" leading to Web Cache DeceptionEPSS 0.5%CVE-2026-39407MEDIUMHono has a middleware bypass via repeated slashes in serveStaticEPSS 0.5%CVE-2025-59139MEDIUMHono has Body Limit Middleware BypassEPSS 0.4%CVE-2026-24473MEDIUMHono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)EPSS 0.4%CVE-2026-54286MEDIUMHono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)EPSS 0.4%CVE-2026-56762MEDIUMHono - Missing Cookie Name Validation in setCookie()EPSS 0.4%CVE-2026-84364MEDIUMHono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustionEPSS 0.4%CVE-2025-62610HIGHHono Improperly Authorizes JWT Audience ValidationEPSS 0.4%CVE-2026-84363MEDIUMHono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentialsEPSS 0.3%CVE-2026-39409MEDIUMHono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addressesEPSS 0.3%CVE-2026-54290HIGHHono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcardEPSS 0.3%CVE-2026-84365MEDIUMHono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directoryEPSS 0.3%CVE-2026-59895MEDIUMHono: Server-Side XSS via JSX Escaping Bypass in cx() UtilityEPSS 0.3%CVE-2026-24398MEDIUMHono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofingEPSS 0.3%