npm / hono

Hono allows bypass of CSRF Middleware by a request without Content-Type header.

Modified: 3/23/2026

Hono missing validation of cookie name on write path in setCookie()

Modified: 4/9/2026

Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Modified: 6/10/2026

Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Modified: 6/10/2026

Hono vulnerable to Restricted Directory Traversal in serveStatic with deno

Modified: 3/23/2026

Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)

Modified: 2/4/2026

hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR

Modified: 4/16/2026

Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()

Modified: 3/18/2026

hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection

Modified: 5/14/2026

Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception

Modified: 2/10/2026

Hono has Body Limit Middleware Bypass

Modified: 3/23/2026

Hono's flaw in URL path parsing could cause path confusion

Modified: 9/5/2025

Hono vulnerable to XSS through ErrorBoundary component

Modified: 2/12/2026

Hono: bodyLimit() can be bypassed for chunked / unknown-length requests

Modified: 5/14/2026

Hono: JWT middleware accepts any Authorization scheme, not only Bearer

Modified: 6/10/2026

Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass

Modified: 2/4/2026

Named path parameters can be overridden in TrieRouter

Modified: 3/23/2026

Hono added timing comparison hardening in basicAuth and bearerAuth

Modified: 2/22/2026

Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

Modified: 5/14/2026

Hono Improper Authorization vulnerability

Modified: 3/23/2026

Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()

Modified: 3/18/2026

Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

Modified: 5/14/2026

Hono vulnerable to arbitrary file access via serveStatic vulnerability

Modified: 3/16/2026

Hono vulnerable to Vary Header Injection leading to potential CORS Bypass

Modified: 11/27/2025

Hono has CSS Declaration Injection via Style Object Values in JSX SSR

Modified: 5/10/2026

Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing

Modified: 2/12/2026

Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()

Modified: 4/9/2026

Hono CSRF middleware can be bypassed using crafted Content-Type header

Modified: 3/23/2026

Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })

Modified: 3/13/2026

Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)

Modified: 2/12/2026

Hono: Middleware bypass via repeated slashes in serveStatic

Modified: 4/9/2026

Hono: Path traversal in toSSG() allows writing files outside the output directory

Modified: 4/9/2026

Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo

Modified: 2/28/2026

Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

Modified: 5/5/2026

Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

Modified: 6/10/2026