Hono records

38 published records for vendor hono.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 100%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

38 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2026-29045No exploit	Hono: Arbitrary file access via serveStatic vulnerabilityhono · hono · CWE-177 Pre-auth	Critical9.8	—	0.6%	Mar 4, 2026
32Monitor	CVE-2025-62610No exploit	Hono Improperly Authorizes JWT Audience Validationhono · hono · CWE-285 Pre-auth Broken access control (IDOR)	High8.1	—	0.3%	Oct 22, 2025
30Monitor	CVE-2024-32652No exploit	@hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsedhono · node-server · CWE-755 Pre-auth Denial of service	High7.5	—	0.8%	Apr 19, 2024
30Monitor	CVE-2025-58362No exploit	Hono contains a flaw in URL path parsing, potentially leading to path confusionhono · hono · CWE-706 Pre-auth	High7.5	—	0.5%	Sep 4, 2025
30Monitor	CVE-2026-29087No exploit	@hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middlewarehono · node-server · CWE-863 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Mar 6, 2026
30Monitor	CVE-2026-27700No exploit	Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfohono · hono · CWE-290 Pre-auth Auth bypass	High7.5	—	0.3%	Feb 25, 2026
26Monitor	CVE-2026-24398No exploit	Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofinghono · hono · CWE-185 Pre-auth	Medium6.5	—	0.3%	Jan 27, 2026
26Monitor	CVE-2026-29085No exploit	Hono: SSE Control Field Injection via CR/LF in writeSSE()hono · hono · CWE-74 Pre-auth	Medium6.5	—	0.3%	Mar 4, 2026
26Monitor	CVE-2026-59896No exploit	hono/jsx does not isolate context per request, leading to cross-request data disclosurehono · hono · CWE-362 Pre-auth Race condition	Medium6.5	—	0.2%	Jul 8, 2026
26Monitor	CVE-2026-44456No exploit	Hono: bodyLimit() can be bypassed for chunked / unknown-length requestshono · hono · CWE-400 Pre-auth Denial of service	Medium6.5	—	0.2%	May 13, 2026
26Monitor	CVE-2026-47673No exploit	Hono: JWT middleware accepts any Authorization scheme, not only Bearerhono · hono · CWE-285 Pre-auth Broken access control (IDOR)	Medium6.5	—	0.1%	May 28, 2026
26Monitor	CVE-2026-22817No exploit	JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypasshono · hono · CWE-347 Pre-auth Auth bypass Weak crypto	Medium6.5	—	0.1%	Jan 13, 2026
26Monitor	CVE-2026-22818No exploit	JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)hono · hono · CWE-347 Pre-auth Weak crypto	Medium6.5	—	0.1%	Jan 13, 2026
25Monitor	CVE-2026-24473No exploit	Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)hono · hono · CWE-200 Pre-auth Info leak	Medium6.3	—	0.4%	Jan 27, 2026
25Monitor	CVE-2026-39409No exploit	Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresseshono · hono · CWE-180 Pre-auth	Medium6.3	—	0.4%	Apr 8, 2026
24Monitor	CVE-2026-59895No exploit	Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utilityhono · hono · CWE-79 Pre-auth XSS	Medium6.1	—	0.3%	Jul 8, 2026
24Monitor	CVE-2026-44455No exploit	Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injectionhono · hono · CWE-74 Pre-auth	Medium6.1	—	0.2%	May 13, 2026
23Monitor	CVE-2026-39408No exploit	Hono has a path traversal in toSSG() allows writing files outside the output directoryhono · hono · CWE-22 Path traversal	Medium5.9	—	0.4%	Apr 8, 2026
23Monitor	CVE-2024-48913No exploit	Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.hono · hono · CWE-352 Pre-auth CSRF	Medium5.9	—	0.3%	Oct 15, 2024
21Monitor	CVE-2024-23340No exploit	@hono/node-server can't handle "double dots" in URLhono · node-server · CWE-22 Pre-auth Path traversal	Medium5.3	—	0.7%	Jan 22, 2024
21Monitor	CVE-2024-32869No exploit	Hono vulnerable to Restricted Directory Traversal in serveStatic with denohono · hono · CWE-22 Pre-auth Path traversal	Medium5.3	—	0.6%	Apr 23, 2024
21Monitor	CVE-2026-24472No exploit	Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deceptionhono · hono · CWE-524 Pre-auth	Medium5.3	—	0.5%	Jan 27, 2026
21Monitor	CVE-2026-39407No exploit	Hono has a middleware bypass via repeated slashes in serveStatichono · hono · CWE-22 Pre-auth Path traversal	Medium5.3	—	0.4%	Apr 8, 2026
21Monitor	CVE-2025-59139Proof of concept	Hono has Body Limit Middleware Bypasshono · hono · CWE-400 Pre-auth Denial of service	Medium5.3	—	0.4%	Sep 12, 2025
21Monitor	CVE-2026-39406No exploit	@hono/node-server has a middleware bypass via repeated slashes in serveStatichono · node-server · CWE-22 Pre-auth Path traversal	Medium5.3	—	0.4%	Apr 8, 2026

CVE-2026-29045
39Monitor
Hono: Arbitrary file access via serveStatic vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
hono · honoMar 4, 2026
CVE-2025-62610
32Monitor
Hono Improperly Authorizes JWT Audience Validation
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
hono · honoOct 22, 2025
CVE-2024-32652
30Monitor
@hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
hono · node-serverApr 19, 2024
CVE-2025-58362
30Monitor
Hono contains a flaw in URL path parsing, potentially leading to path confusion
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
hono · honoSep 4, 2025
CVE-2026-29087
30Monitor
@hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
hono · node-serverMar 6, 2026
CVE-2026-27700
30Monitor
Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
hono · honoFeb 25, 2026
CVE-2026-24398
26Monitor
Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
hono · honoJan 27, 2026
CVE-2026-29085
26Monitor
Hono: SSE Control Field Injection via CR/LF in writeSSE()
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
hono · honoMar 4, 2026
CVE-2026-59896
26Monitor
hono/jsx does not isolate context per request, leading to cross-request data disclosure
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- Race condition
hono · honoJul 8, 2026
CVE-2026-44456
26Monitor
Hono: bodyLimit() can be bypassed for chunked / unknown-length requests
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- Denial of service
hono · honoMay 13, 2026
CVE-2026-47673
26Monitor
Hono: JWT middleware accepts any Authorization scheme, not only Bearer
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
hono · honoMay 28, 2026
CVE-2026-22817
26Monitor
JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Weak crypto
hono · honoJan 13, 2026
CVE-2026-22818
26Monitor
JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
hono · honoJan 13, 2026
CVE-2026-24473
25Monitor
Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)
MediumCVSS 6.3No exploitEPSS 0%
- Pre-auth
- Info leak
hono · honoJan 27, 2026
CVE-2026-39409
25Monitor
Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses
MediumCVSS 6.3No exploitEPSS 0%
- Pre-auth
hono · honoApr 8, 2026
CVE-2026-59895
24Monitor
Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
hono · honoJul 8, 2026
CVE-2026-44455
24Monitor
Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
hono · honoMay 13, 2026
CVE-2026-39408
23Monitor
Hono has a path traversal in toSSG() allows writing files outside the output directory
MediumCVSS 5.9No exploitEPSS 0%
- Path traversal
hono · honoApr 8, 2026
CVE-2024-48913
23Monitor
Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.
MediumCVSS 5.9No exploitEPSS 0%
- Pre-auth
- CSRF
hono · honoOct 15, 2024
CVE-2024-23340
21Monitor
@hono/node-server can't handle "double dots" in URL
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- Path traversal
hono · node-serverJan 22, 2024
CVE-2024-32869
21Monitor
Hono vulnerable to Restricted Directory Traversal in serveStatic with deno
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- Path traversal
hono · honoApr 23, 2024
CVE-2026-24472
21Monitor
Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
hono · honoJan 27, 2026
CVE-2026-39407
21Monitor
Hono has a middleware bypass via repeated slashes in serveStatic
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- Path traversal
hono · honoApr 8, 2026
CVE-2025-59139
21Monitor
Hono has Body Limit Middleware Bypass
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
hono · honoSep 12, 2025
CVE-2026-39406
21Monitor
@hono/node-server has a middleware bypass via repeated slashes in serveStatic
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- Path traversal
hono · node-serverApr 8, 2026