Hono kayıtları
hono üreticisine ait 38 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 1
- Düzeltme kaydı olan
- %100
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')5
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')3
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')3
- CWE-524 Use of Cache Containing Sensitive Information2
- CWE-185 Incorrect Regular Expression2
- CWE-400 Uncontrolled Resource Consumption2
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
38 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
39İzleyin | CVE-2026-29045İstismar yok | Hono: Arbitrary file access via serveStatic vulnerabilityhono · hono · CWE-177 | Kritik9,8 | — | %0,6 | 4 Mar 2026 |
32İzleyin | CVE-2025-62610İstismar yok | Hono Improperly Authorizes JWT Audience Validationhono · hono · CWE-285 | Yüksek8,1 | — | %0,4 | 22 Eki 2025 |
30İzleyin | CVE-2024-32652İstismar yok | @hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsedhono · node-server · CWE-755 | Yüksek7,5 | — | %0,9 | 19 Nis 2024 |
30İzleyin | CVE-2025-58362İstismar yok | Hono contains a flaw in URL path parsing, potentially leading to path confusionhono · hono · CWE-706 | Yüksek7,5 | — | %0,5 | 4 Eyl 2025 |
30İzleyin | CVE-2026-29087İstismar yok | @hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middlewarehono · node-server · CWE-863 | Yüksek7,5 | — | %0,4 | 6 Mar 2026 |
30İzleyin | CVE-2026-27700İstismar yok | Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfohono · hono · CWE-290 | Yüksek7,5 | — | %0,3 | 25 Şub 2026 |
26İzleyin | CVE-2026-24398İstismar yok | Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofinghono · hono · CWE-185 | Orta6,5 | — | %0,4 | 27 Oca 2026 |
26İzleyin | CVE-2026-59896İstismar yok | hono/jsx does not isolate context per request, leading to cross-request data disclosurehono · hono · CWE-362 | Orta6,5 | — | %0,3 | 8 Tem 2026 |
26İzleyin | CVE-2026-29085İstismar yok | Hono: SSE Control Field Injection via CR/LF in writeSSE()hono · hono · CWE-74 | Orta6,5 | — | %0,3 | 4 Mar 2026 |
26İzleyin | CVE-2026-44456İstismar yok | Hono: bodyLimit() can be bypassed for chunked / unknown-length requestshono · hono · CWE-400 | Orta6,5 | — | %0,3 | 13 May 2026 |
26İzleyin | CVE-2026-47673İstismar yok | Hono: JWT middleware accepts any Authorization scheme, not only Bearerhono · hono · CWE-285 | Orta6,5 | — | %0,3 | 28 May 2026 |
26İzleyin | CVE-2026-22817İstismar yok | JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypasshono · hono · CWE-347 | Orta6,5 | — | %0,2 | 13 Oca 2026 |
26İzleyin | CVE-2026-22818İstismar yok | JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)hono · hono · CWE-347 | Orta6,5 | — | %0,1 | 13 Oca 2026 |
25İzleyin | CVE-2026-24473İstismar yok | Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)hono · hono · CWE-200 | Orta6,3 | — | %0,5 | 27 Oca 2026 |
25İzleyin | CVE-2026-39409İstismar yok | Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresseshono · hono · CWE-180 | Orta6,3 | — | %0,4 | 8 Nis 2026 |
24İzleyin | CVE-2026-59895İstismar yok | Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utilityhono · hono · CWE-79 | Orta6,1 | — | %0,3 | 8 Tem 2026 |
24İzleyin | CVE-2026-44455İstismar yok | Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injectionhono · hono · CWE-74 | Orta6,1 | — | %0,2 | 13 May 2026 |
23İzleyin | CVE-2026-39408İstismar yok | Hono has a path traversal in toSSG() allows writing files outside the output directoryhono · hono · CWE-22 | Orta5,9 | — | %0,5 | 8 Nis 2026 |
23İzleyin | CVE-2024-48913İstismar yok | Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.hono · hono · CWE-352 | Orta5,9 | — | %0,3 | 15 Eki 2024 |
21İzleyin | CVE-2024-23340İstismar yok | @hono/node-server can't handle "double dots" in URLhono · node-server · CWE-22 | Orta5,3 | — | %0,7 | 22 Oca 2024 |
21İzleyin | CVE-2024-32869İstismar yok | Hono vulnerable to Restricted Directory Traversal in serveStatic with denohono · hono · CWE-22 | Orta5,3 | — | %0,6 | 23 Nis 2024 |
21İzleyin | CVE-2026-24472İstismar yok | Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deceptionhono · hono · CWE-524 | Orta5,3 | — | %0,5 | 27 Oca 2026 |
21İzleyin | CVE-2026-39407İstismar yok | Hono has a middleware bypass via repeated slashes in serveStatichono · hono · CWE-22 | Orta5,3 | — | %0,5 | 8 Nis 2026 |
21İzleyin | CVE-2025-59139Kavram kanıtı | Hono has Body Limit Middleware Bypasshono · hono · CWE-400 | Orta5,3 | — | %0,5 | 12 Eyl 2025 |
21İzleyin | CVE-2026-39406İstismar yok | @hono/node-server has a middleware bypass via repeated slashes in serveStatichono · node-server · CWE-22 | Orta5,3 | — | %0,4 | 8 Nis 2026 |
- CVE-2026-2904539İzleyin
Hono: Arbitrary file access via serveStatic vulnerability
KritikCVSS 9,8İstismar yokEPSS %1hono · hono4 Mar 2026
- CVE-2025-6261032İzleyin
Hono Improperly Authorizes JWT Audience Validation
YüksekCVSS 8,1İstismar yokEPSS %0hono · hono22 Eki 2025
- CVE-2024-3265230İzleyin
@hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed
YüksekCVSS 7,5İstismar yokEPSS %1hono · node-server19 Nis 2024
- CVE-2025-5836230İzleyin
Hono contains a flaw in URL path parsing, potentially leading to path confusion
YüksekCVSS 7,5İstismar yokEPSS %1hono · hono4 Eyl 2025
- CVE-2026-2908730İzleyin
@hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
YüksekCVSS 7,5İstismar yokEPSS %0hono · node-server6 Mar 2026
- CVE-2026-2770030İzleyin
Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
YüksekCVSS 7,5İstismar yokEPSS %0hono · hono25 Şub 2026
- CVE-2026-2439826İzleyin
Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing
OrtaCVSS 6,5İstismar yokEPSS %0hono · hono27 Oca 2026
- CVE-2026-5989626İzleyin
hono/jsx does not isolate context per request, leading to cross-request data disclosure
OrtaCVSS 6,5İstismar yokEPSS %0hono · hono8 Tem 2026
- CVE-2026-2908526İzleyin
Hono: SSE Control Field Injection via CR/LF in writeSSE()
OrtaCVSS 6,5İstismar yokEPSS %0hono · hono4 Mar 2026
- CVE-2026-4445626İzleyin
Hono: bodyLimit() can be bypassed for chunked / unknown-length requests
OrtaCVSS 6,5İstismar yokEPSS %0hono · hono13 May 2026
- CVE-2026-4767326İzleyin
Hono: JWT middleware accepts any Authorization scheme, not only Bearer
OrtaCVSS 6,5İstismar yokEPSS %0hono · hono28 May 2026
- CVE-2026-2281726İzleyin
JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass
OrtaCVSS 6,5İstismar yokEPSS %0hono · hono13 Oca 2026
- CVE-2026-2281826İzleyin
JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)
OrtaCVSS 6,5İstismar yokEPSS %0hono · hono13 Oca 2026
- CVE-2026-2447325İzleyin
Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)
OrtaCVSS 6,3İstismar yokEPSS %0hono · hono27 Oca 2026
- CVE-2026-3940925İzleyin
Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses
OrtaCVSS 6,3İstismar yokEPSS %0hono · hono8 Nis 2026
- CVE-2026-5989524İzleyin
Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility
OrtaCVSS 6,1İstismar yokEPSS %0hono · hono8 Tem 2026
- CVE-2026-4445524İzleyin
Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection
OrtaCVSS 6,1İstismar yokEPSS %0hono · hono13 May 2026
- CVE-2026-3940823İzleyin
Hono has a path traversal in toSSG() allows writing files outside the output directory
OrtaCVSS 5,9İstismar yokEPSS %0hono · hono8 Nis 2026
- CVE-2024-4891323İzleyin
Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.
OrtaCVSS 5,9İstismar yokEPSS %0hono · hono15 Eki 2024
- CVE-2024-2334021İzleyin
@hono/node-server can't handle "double dots" in URL
OrtaCVSS 5,3İstismar yokEPSS %1hono · node-server22 Oca 2024
- CVE-2024-3286921İzleyin
Hono vulnerable to Restricted Directory Traversal in serveStatic with deno
OrtaCVSS 5,3İstismar yokEPSS %1hono · hono23 Nis 2024
- CVE-2026-2447221İzleyin
Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception
OrtaCVSS 5,3İstismar yokEPSS %1hono · hono27 Oca 2026
- CVE-2026-3940721İzleyin
Hono has a middleware bypass via repeated slashes in serveStatic
OrtaCVSS 5,3İstismar yokEPSS %0hono · hono8 Nis 2026
- CVE-2025-5913921İzleyin
Hono has Body Limit Middleware Bypass
OrtaCVSS 5,3Kavram kanıtıEPSS %0hono · hono12 Eyl 2025
- CVE-2026-3940621İzleyin
@hono/node-server has a middleware bypass via repeated slashes in serveStatic
OrtaCVSS 5,3İstismar yokEPSS %0hono · node-server8 Nis 2026