honojs vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20245
3. 20253
4. 202646

Newest CVEs

• CVE-2026-118663

  @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

  honojs · node-server

  Medium5.3
• CVE-2026-111757

  Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

  honojs · hono

  Medium5.3
• CVE-2026-109955

  Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding

  honojs · hono

  Medium6.9
• CVE-2026-93981

  hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

  honojs · hono

  Low2.3
• CVE-2026-84365

  Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

  honojs · hono

  Medium6.5
• CVE-2026-84364

  Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

  honojs · hono

  Medium5.3
• CVE-2026-84363

  Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

  honojs · hono

  Medium5.9
• CVE-2026-81888

  @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

  honojs · @hono/oauth-providers

  Medium5.4
• CVE-2026-73565

  @hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake

  honojs · node-server

  Medium5.3
• CVE-2026-69207

  Hono: ReDoS in CORS middleware via Access-Control-Request-Headers

  honojs · hono

  Medium5.3