npm

hono

50 Total advisories

50 Vulnerabilities

0 Malware

Dependency scanning

Check whether hono is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

hono

Vulnerabilities

Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

Hono: ReDoS in CORS middleware via Access-Control-Request-Headers

Hono: Proxy Helper does not remove response headers listed in the `Connection` header

Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

Hono: Path traversal in toSSG() allows writing files outside the output directory

Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()

Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)

Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing

Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)

Hono CSRF middleware can be bypassed using crafted Content-Type header

Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Hono: Algorithmic Complexity DoS in Language Middleware

Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`

hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice

Hono: JWT middleware accepts any Authorization scheme, not only Bearer

hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard

Hono has CSS Declaration Injection via Style Object Values in JSX SSR

Hono: bodyLimit() can be bypassed for chunked / unknown-length requests

hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection

Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

Hono: Middleware bypass via repeated slashes in serveStatic

hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR

Hono missing validation of cookie name on write path in setCookie()

Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })

Hono vulnerable to arbitrary file access via serveStatic vulnerability

Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()

Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()

Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo

Hono added timing comparison hardening in basicAuth and bearerAuth

Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass

Hono vulnerable to XSS through ErrorBoundary component

Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception

Hono Improper Authorization vulnerability

Hono has Body Limit Middleware Bypass

Hono allows bypass of CSRF Middleware by a request without Content-Type header.

hono/jsx does not isolate context per request, leading to cross-request data disclosure

Hono vulnerable to Restricted Directory Traversal in serveStatic with deno

Named path parameters can be overridden in TrieRouter

Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Hono vulnerable to Vary Header Injection leading to potential CORS Bypass

Hono's flaw in URL path parsing could cause path confusion

Browse more npm advisories

Start Securing

Hono vulnerable to Prototype Pollution possible through proto key allowed in parseBody({ dot: true })