Honojs vulnerabilities
We track 8 vulnerabilities in Honojs products across 2 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on June 22, 2026.
Latest Honojs vulnerabilities
- 7.1 High severity
hono: Permissive Cross-domain Security Policy with Untrusted Domains
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Crede
- 7.5 High severity
hono: Improper Limitation of a Pathname to a Restricted Directory
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be written outside the configured output directory during static site generation. When using dynamic route
- 7.5 High severity
node-server: Incorrect Authorization
@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting /admin/*), inconsistent URL decoding can allow prot
- 9.8 Critical severity
hono: Improper Handling of URL Encoding (Hex Encoding)
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected
- 7.5 High severity
hono: Authentication Bypass by Spoofing
Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter (`hono/aws-lambda`) behind an Application Load Balancer (ALB), the `getConnInfo()` function incorrectly selec
- 8.1 High severity
hono: Improper Authorization
Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middleware does not provide a built-in aud (Audience) verification option, which can cause confused-deputy / token-mi
- 7.5 High severity
hono: Use of Incorrectly-Resolved Name or Reference
Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility function which could allow path confusion and potential bypass of proxy-level ACLs (e.g. Nginx location blo
- 7.5 High severity
node-server: Improper Handling of Exceptional Conditions
The adapter @hono/node-server allows you to run your Hono application on Node.js. Prior to 1.10.1, the application hangs when receiving a Host header with a value that `@hono/node-server` can't handle well. Invalid values are those that cannot be parsed by the