Hono
Monthly
@hono/node-server versions prior to 1.19.10 contain an authorization bypass in static file serving due to inconsistent URL decoding between routing middleware and file resolution logic. An unauthenticated remote attacker can bypass route-based access controls by crafting requests with encoded slashes (%2F) to access protected static resources that should be restricted by middleware. Organizations running affected versions should upgrade immediately as no workaround is available.
Hono versions prior to 4.12.4 suffer from an authentication bypass in serveStatic when combined with route-based middleware protections due to inconsistent URL decoding between the router and file serving components. An unauthenticated remote attacker can exploit this mismatch by encoding slashes (%2F) in request paths to access protected static resources that should be restricted by middleware rules. A patch is available in version 4.12.4 and later.
Hono is a Web application framework that provides support for any JavaScript runtime. [CVSS 8.2 HIGH]
Hono versions before 4.11.4 allow JWT algorithm confusion attacks through improper algorithm validation in the JWK/JWKS verification middleware, enabling attackers to forge valid tokens when the selected JWK lacks an explicit algorithm definition. An unauthenticated remote attacker can exploit this to bypass JWT signature verification and gain unauthorized access to affected applications. The vulnerability has been patched in version 4.11.4, which now requires explicit algorithm allowlists instead of deriving algorithms from untrusted JWT headers.
Hono before version 4.11.4 contains a JWT algorithm confusion vulnerability in its JWK/JWKS verification middleware that allows attackers to forge authentication tokens when the JWK lacks explicit algorithm specification. An unauthenticated remote attacker can exploit this by manipulating the JWT header's alg value to bypass signature verification in affected configurations. The vulnerability is resolved in version 4.11.4, which now requires explicit algorithm specification to prevent header-driven algorithm confusion.
Static-file disclosure in Hono's serveStatic middleware (versions 4.12.4 through 4.13.10) lets remote attackers read files that routing-level access controls were meant to protect, by requesting a malformed percent-encoded path such as '/static/%%36%31dmin/secret.txt' that only normalizes to the protected path during serveStatic's second decode. Affected deployments are those that guard a sub-prefix of the static root with upstream middleware (for example app.use('/static/admin/*', auth) in front of serveStatic('/static/*')); attackers gain read-only access to files already inside the configured static root, with no traversal outside it and no write or availability impact, giving CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) with authentication requirements not applicable per the PR:N vector. No public exploit code or CISA KEV entry was identified at time of analysis; exploitation requires the specific non-default middleware-on-sub-prefix layout, so real-world risk is a moderate, conditional information-disclosure issue rather than a critical one.
Authentication bypass in Hono 4.12.4 up to (but not including) 4.13.11 lets unauthenticated remote attackers read static files that are supposed to be gated by prefix-mounted middleware: a malformed, double percent-encoded path is matched by the router in its encoded form, so middleware mounted on the decoded prefix never runs while serveStatic still resolves and serves the underlying file. The impact is limited to confidentiality of the exposed static content (assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - no integrity or availability effect), and only deployments that both use serveStatic and rely on prefix-based middleware for access control are meaningfully exposed. No public exploit identified at time of analysis, and the vendor-released fix is Hono 4.13.11.
Cross-site scripting in Hono before 4.13.7 allows unauthenticated remote attackers to inject arbitrary HTML and execute script in a victim's browser under the application's origin when the application uses hono/jsx server-side rendering in one of four specific patterns involving plain strings: as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. Exploitation requires attacker-controlled data to flow directly into those strings during SSR and a victim to load the rendered output, making this a low-priority XSS despite the network attack vector and no authentication requirement. No public exploit code has been identified at time of analysis, and the issue is fixed in Hono 4.13.7.
Path traversal in Hono's toSSG() static site generator allows untrusted ssgParams values - such as slugs sourced from a CMS, external API, or user submission - to create or overwrite files outside the configured output directory at build time. Versions 4.12.12 through 4.13.4 are affected; the root cause is an incomplete fix for CVE-2026-39408 that fails to collapse consecutive parent-directory segments (e.g., 'a/b/../../../') in route parameter values, and also mishandles Windows drive-relative and UNC path roots. No public exploit has been identified and the vulnerability is not confirmed in the CISA KEV catalog; a complete patch is available in v4.13.5.
Heap-exhaustion denial-of-service in Hono web framework before 4.13.5 allows unauthenticated network attackers to crash the JavaScript server process by submitting form requests with deeply nested or numerous dot-separated field names when dot-notation parsing is explicitly enabled. The `parseBody()` function expands dot-separated keys into nested JavaScript objects without any bound on nesting depth or total intermediate object count, allowing a normal-sized request body to produce an object graph orders of magnitude larger and exhaust the runtime heap. Exploitation causes server process termination and service outage until manual restart; no public exploit is identified at time of analysis.
Cache poisoning and stored XSS in Hono (all versions before 4.13.5) stem from the framework's query helpers treating a literal `#?` sequence as a query string, creating a parser discrepancy between the application and every other layer - browsers, reverse proxies, WAFs, access logs, and validation middleware - that correctly ignores fragments. The Cache Middleware compounded this by stripping fragments when building cache keys, so a response shaped by fragment-injected parameters gets stored and served to subsequent users under a key that omits those parameters entirely. No public exploit code has been identified at time of analysis, and exploitation is gated by the requirement that the runtime and intermediary pass raw `#` characters through to the application.
Cross-user HTML disclosure in Hono's server-side rendering affects all applications using hono/jsx with memo()-wrapped components that read request-scoped context. On a warm server instance, when two requests share comparator-equal props, the memoized render from the first request is served to the second user verbatim - bypassing per-request context isolation for values obtained via createContext()/useContext(), useRequestContext(), or getContext(). This can leak another user's profile data, CSRF tokens embedded in HTML, or role-gated content. No public exploit or CISA KEV listing exists at time of analysis; the vendor released a confirmed fix in v4.12.34.
Hono's `proxy()` function in the `hono/proxy` Proxy Helper leaks connection-scoped response headers to downstream clients by failing to strip headers named in the origin's `Connection` response field, violating RFC 9110 Section 7.6.1. Versions 4.7.0 through 4.12.33 of the npm `hono` package are affected; the function correctly removed well-known hop-by-hop headers but neglected to parse and remove the additional headers the origin declared as connection-scoped via `Connection`. No public exploit has been identified at time of analysis and exploitation is conditional on non-default origin behavior, limiting real-world priority despite the network-reachable attack vector.
Quadratic-complexity denial of service in Hono's `languageDetector` middleware (versions 4.12.0-4.12.33) allows unauthenticated remote attackers to exhaust CPU resources by sending HTTP requests with crafted language tags containing large numbers of hyphen-separated subtags. The default middleware configuration accepts language values from query parameters, cookies, and the Accept-Language header without authentication, meaning the vulnerable code path is reachable from the network in any default Hono deployment using this middleware. No public exploit code has been identified and this CVE is not in the CISA KEV catalog, but the attack is trivially constructible from the advisory description; the fix was released in version 4.12.34.
Credential inference via timing side-channel is possible in Hono before 4.11.10 when the built-in `basicAuth` or `bearerAuth` middlewares are in use, due to JavaScript's short-circuit `===` string equality operator being used inside the `timingSafeEqual` function for hash comparison. Because `===` terminates on the first differing character, response times vary slightly based on how many leading characters of a credential match the stored hash, enabling an attacker to recover credentials one character at a time through statistical timing analysis. No public exploit has been identified and the vendor GHSA advisory explicitly characterizes this as a hardening improvement with low practical exploitability outside highly controlled, low-jitter network environments.
Prototype pollution in Hono before 4.12.7 enables unauthenticated remote attackers to inject properties into JavaScript's Object.prototype by submitting crafted form field names containing '__proto__' keys when the 'dot' option is enabled in parseBody. Exploitation is conditional - it further requires that application code merges parsed body output into plain JavaScript objects using unsafe merge patterns - but when both conditions are present, attackers can silently alter inherited object behavior across the entire runtime, potentially bypassing authorization checks or leaking sensitive data. No public exploit code or CISA KEV listing exists at time of analysis; the CVSS 4.0 score of 6.3 reflects limited impact and the attack prerequisite of the non-default dot option being enabled.
Server-side rendering XSS in Hono's hono/css module (versions 4.0.0 through 4.12.26) allows injection of arbitrary HTML markup by exploiting the cx() function's failure to HTML-escape input before marking it as safe. When untrusted data flows into a cx() call used in a JSX class attribute during SSR, attackers can break out of the attribute context and inject arbitrary markup or script into the rendered page delivered to victims. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 6.1 Medium score with Scope:Changed reflects the cross-context server-to-browser impact.
Server-side rendering in Hono's JSX module (versions 4.11.8 through before 4.12.27) fails to isolate context values per request, enabling cross-request data leakage under concurrent load. When async components yield at an await boundary, the shared context store can be overwritten by a concurrent in-flight request, causing createContext, useContext, jsxRenderer, or useRequestContext data from one user's session to bleed into another user's response. No public exploit has been identified at time of analysis, but the C:H CVSS impact rating reflects that leaked context values frequently carry sensitive per-user material such as authentication state, session tokens, or profile data.
Header de-duplication logic in Hono's AWS API Gateway v1 adapter silently drops distinct repeated header values because it uses substring comparison rather than exact string equality, meaning a value like '10.0.0.1' would incorrectly suppress '10.0.0.10'. Middleware or application logic relying on a complete X-Forwarded-For chain, rate limiting counters, audit trail integrity, or proxy-chain trust validation receives a truncated view of the request. Affected versions span 4.3.3 through 4.12.26; no public exploit identified at time of analysis, though the GitHub advisory confirms the issue and a fix is released in v4.12.27.
Header injection in Hono's CORS middleware exposes applications to cache key pollution across versions before 4.10.3. When the CORS `origin` option is configured to anything other than wildcard `*`, the middleware incorrectly promotes client-supplied `Vary` header values from the incoming request directly into the HTTP response - a behavior violating the HTTP specification, which reserves `Vary` as a server-managed response header. In environments using shared caches, CDNs, or reverse proxies, an attacker can craft requests with arbitrary `Vary` values to poison cache entries, potentially causing incorrect CORS policies to be enforced for legitimate downstream users. No public exploit code and no CISA KEV listing have been identified at time of analysis.
HTML injection in Hono's JSX server-side rendering engine (versions before 4.12.14) allows network-accessible attackers to corrupt rendered HTML output by supplying malformed attribute names containing characters such as quotes or angle brackets. Applications that pass untrusted external input - query parameters, form data, or other user-controlled values - directly as JSX attribute keys during SSR are affected. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis; however, successful exploitation against vulnerable application patterns can escalate to cross-site scripting if the injected HTML includes event handlers processed by the victim's browser.
Missing cookie name validation on the write path in Hono's setCookie(), serialize(), and serializeSigned() functions allows user-controlled input containing CRLF control characters to produce malformed Set-Cookie headers. Affected are all Hono npm releases before 4.12.12. In practice, modern runtimes including Node.js and Cloudflare Workers reject the malformed headers before they are transmitted, meaning confirmed impact is availability loss (runtime errors crashing the response) rather than header injection or response splitting - though theoretical risk exists on less-strict runtimes. No active exploitation is confirmed, and no public exploit code has been identified.
Hono's jwt and jwk middleware components fail to enforce the Bearer scheme in the Authorization header, allowing any two-part header value - such as 'Basic <token>' or 'Token <token>' - to pass JWT verification identically to a correctly formed Bearer request. All Hono releases prior to 4.12.21 on any supported JavaScript runtime are affected when these middlewares protect routes. No public exploit identified at time of analysis, and this is not listed in CISA KEV; real-world exploitation requires the attacker to already possess a valid, properly signed JWT.
IP restriction bypass in Hono's ip-restriction middleware (hono/ip-restriction) prior to version 4.12.21 allows unauthenticated remote attackers to circumvent configured deny and allow rules by submitting non-canonical IPv6 representations of restricted addresses. String equality comparison applied after only partial normalization means that compressed, explicit-zero, or hex-notation IPv4-mapped IPv6 forms of a listed address silently fail to match the normalized rule entry, causing enforcement to be skipped entirely. No public exploit has been identified at time of analysis, but the bypass requires only trivial reformatting of a standard IPv6 address, making it practically low-effort for any attacker aware of the flaw.
HTTP response header injection in Hono's cookie serialize() function allows unauthenticated remote attackers to inject arbitrary Set-Cookie attributes when an application passes user-controlled input into the sameSite or priority cookie options. All Hono releases prior to 4.12.21 are affected across every supported JavaScript runtime. No public exploit code exists at time of analysis, and the vulnerability is not listed in CISA KEV, though the low attack complexity and network-accessible vector make it exploitable wherever the affected code path is reachable by user-supplied data.
Path prefix stripping in Hono's app.mount() API exposes mounted sub-applications to incorrect routing due to a raw-vs-decoded URL path inconsistency, potentially allowing unauthenticated remote attackers to reach unintended endpoints and disclose protected information. All Hono versions prior to 4.12.21 are affected across every supported JavaScript runtime. No public exploit or CISA KEV listing exists at time of analysis; however, the CVSS vector AV:N/AC:L/PR:N/UI:N and the 'Information Disclosure / Request Smuggling' classification make this a meaningful priority for any deployment that relies on mount-prefix path logic for access segregation.
Hono versions up to 4.12.4 contains a vulnerability that allows attackers to injection of additional cookie attributes if untrusted input was passed into the (CVSS 5.4).
Hono versions up to 4.12.4 contains a vulnerability that allows attackers to injection of additional SSE fields within the same event frame if untrusted inpu (CVSS 6.5).
Hono's ErrorBoundary JSX component before version 4.11.7 fails to properly sanitize user-controlled input, allowing attackers to inject and execute arbitrary JavaScript in victims' browsers through reflected XSS. The vulnerability requires user interaction and network access but can compromise the confidentiality and integrity of affected applications. A patch is available in version 4.11.7.
Hono versions before 4.11.7 contain an information disclosure vulnerability in the static file serving middleware for Cloudflare Workers that allows unauthenticated remote attackers to read sensitive environment keys through path traversal. The lack of proper input validation enables attackers to access internal asset keys that should remain protected. A patch is available in version 4.11.7 and later.
Hono versions up to 4.11.7 contains a vulnerability that allows attackers to private or authenticated responses being cached and subsequently exposed to unau (CVSS 5.3).
Hono's IP Restriction Middleware fails to properly validate IPv4 octet ranges, allowing attackers to bypass IP-based access controls by submitting malformed addresses with values exceeding 255. This affects all users relying on Hono's IP filtering mechanisms for authentication or authorization. A patch is available in version 4.11.7 and later.
Improper authorization in Hono's JWT Auth Middleware (hono/jwt in the npm package 'hono', versions 1.1.0 through 4.10.1) causes the API to accept a correctly signed token that was issued for a different audience, producing confused-deputy / token-mix-up behavior whenever multiple services share the same JWT issuer and signing key. Because the middleware exposed no aud verification option at all before 4.10.2 (documented options covered only iss/nbf/iat/exp), any such shared-key deployment was left unvalidated by default with no misconfiguration required; however, the attacker must already possess a valid, correctly signed token minted for another audience in the same trust domain, and a multi-service shared-key architecture must exist, so a fully anonymous outsider cannot exploit it. Public reporting is limited to the vendor GitHub advisory (which deliberately withholds reproduction steps) and the upstream fix commit, the EPSS score is low at 0.38% (30th percentile), there is no CISA KEV listing, and the vendor-released patch is Hono 4.10.2. Signals are mixed and point to a conditional, moderate real-world priority rather than a drop-everything emergency.
Hono is a Web application framework that provides support for any JavaScript runtime. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Hono is a Web application framework that provides support for any JavaScript runtime. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery (CSRF) middleware by a request without Content-Type header. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Hono is a Web application framework that provides support for any JavaScript runtime. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Hono is a Web application framework that provides support for any JavaScript runtime. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The adapter @hono/node-server allows you to run your Hono application on Node.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Hono is a web framework written in TypeScript. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
@hono/node-server versions prior to 1.19.10 contain an authorization bypass in static file serving due to inconsistent URL decoding between routing middleware and file resolution logic. An unauthenticated remote attacker can bypass route-based access controls by crafting requests with encoded slashes (%2F) to access protected static resources that should be restricted by middleware. Organizations running affected versions should upgrade immediately as no workaround is available.
Hono versions prior to 4.12.4 suffer from an authentication bypass in serveStatic when combined with route-based middleware protections due to inconsistent URL decoding between the router and file serving components. An unauthenticated remote attacker can exploit this mismatch by encoding slashes (%2F) in request paths to access protected static resources that should be restricted by middleware rules. A patch is available in version 4.12.4 and later.
Hono is a Web application framework that provides support for any JavaScript runtime. [CVSS 8.2 HIGH]
Hono versions before 4.11.4 allow JWT algorithm confusion attacks through improper algorithm validation in the JWK/JWKS verification middleware, enabling attackers to forge valid tokens when the selected JWK lacks an explicit algorithm definition. An unauthenticated remote attacker can exploit this to bypass JWT signature verification and gain unauthorized access to affected applications. The vulnerability has been patched in version 4.11.4, which now requires explicit algorithm allowlists instead of deriving algorithms from untrusted JWT headers.
Hono before version 4.11.4 contains a JWT algorithm confusion vulnerability in its JWK/JWKS verification middleware that allows attackers to forge authentication tokens when the JWK lacks explicit algorithm specification. An unauthenticated remote attacker can exploit this by manipulating the JWT header's alg value to bypass signature verification in affected configurations. The vulnerability is resolved in version 4.11.4, which now requires explicit algorithm specification to prevent header-driven algorithm confusion.
Static-file disclosure in Hono's serveStatic middleware (versions 4.12.4 through 4.13.10) lets remote attackers read files that routing-level access controls were meant to protect, by requesting a malformed percent-encoded path such as '/static/%%36%31dmin/secret.txt' that only normalizes to the protected path during serveStatic's second decode. Affected deployments are those that guard a sub-prefix of the static root with upstream middleware (for example app.use('/static/admin/*', auth) in front of serveStatic('/static/*')); attackers gain read-only access to files already inside the configured static root, with no traversal outside it and no write or availability impact, giving CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) with authentication requirements not applicable per the PR:N vector. No public exploit code or CISA KEV entry was identified at time of analysis; exploitation requires the specific non-default middleware-on-sub-prefix layout, so real-world risk is a moderate, conditional information-disclosure issue rather than a critical one.
Authentication bypass in Hono 4.12.4 up to (but not including) 4.13.11 lets unauthenticated remote attackers read static files that are supposed to be gated by prefix-mounted middleware: a malformed, double percent-encoded path is matched by the router in its encoded form, so middleware mounted on the decoded prefix never runs while serveStatic still resolves and serves the underlying file. The impact is limited to confidentiality of the exposed static content (assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - no integrity or availability effect), and only deployments that both use serveStatic and rely on prefix-based middleware for access control are meaningfully exposed. No public exploit identified at time of analysis, and the vendor-released fix is Hono 4.13.11.
Cross-site scripting in Hono before 4.13.7 allows unauthenticated remote attackers to inject arbitrary HTML and execute script in a victim's browser under the application's origin when the application uses hono/jsx server-side rendering in one of four specific patterns involving plain strings: as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. Exploitation requires attacker-controlled data to flow directly into those strings during SSR and a victim to load the rendered output, making this a low-priority XSS despite the network attack vector and no authentication requirement. No public exploit code has been identified at time of analysis, and the issue is fixed in Hono 4.13.7.
Path traversal in Hono's toSSG() static site generator allows untrusted ssgParams values - such as slugs sourced from a CMS, external API, or user submission - to create or overwrite files outside the configured output directory at build time. Versions 4.12.12 through 4.13.4 are affected; the root cause is an incomplete fix for CVE-2026-39408 that fails to collapse consecutive parent-directory segments (e.g., 'a/b/../../../') in route parameter values, and also mishandles Windows drive-relative and UNC path roots. No public exploit has been identified and the vulnerability is not confirmed in the CISA KEV catalog; a complete patch is available in v4.13.5.
Heap-exhaustion denial-of-service in Hono web framework before 4.13.5 allows unauthenticated network attackers to crash the JavaScript server process by submitting form requests with deeply nested or numerous dot-separated field names when dot-notation parsing is explicitly enabled. The `parseBody()` function expands dot-separated keys into nested JavaScript objects without any bound on nesting depth or total intermediate object count, allowing a normal-sized request body to produce an object graph orders of magnitude larger and exhaust the runtime heap. Exploitation causes server process termination and service outage until manual restart; no public exploit is identified at time of analysis.
Cache poisoning and stored XSS in Hono (all versions before 4.13.5) stem from the framework's query helpers treating a literal `#?` sequence as a query string, creating a parser discrepancy between the application and every other layer - browsers, reverse proxies, WAFs, access logs, and validation middleware - that correctly ignores fragments. The Cache Middleware compounded this by stripping fragments when building cache keys, so a response shaped by fragment-injected parameters gets stored and served to subsequent users under a key that omits those parameters entirely. No public exploit code has been identified at time of analysis, and exploitation is gated by the requirement that the runtime and intermediary pass raw `#` characters through to the application.
Cross-user HTML disclosure in Hono's server-side rendering affects all applications using hono/jsx with memo()-wrapped components that read request-scoped context. On a warm server instance, when two requests share comparator-equal props, the memoized render from the first request is served to the second user verbatim - bypassing per-request context isolation for values obtained via createContext()/useContext(), useRequestContext(), or getContext(). This can leak another user's profile data, CSRF tokens embedded in HTML, or role-gated content. No public exploit or CISA KEV listing exists at time of analysis; the vendor released a confirmed fix in v4.12.34.
Hono's `proxy()` function in the `hono/proxy` Proxy Helper leaks connection-scoped response headers to downstream clients by failing to strip headers named in the origin's `Connection` response field, violating RFC 9110 Section 7.6.1. Versions 4.7.0 through 4.12.33 of the npm `hono` package are affected; the function correctly removed well-known hop-by-hop headers but neglected to parse and remove the additional headers the origin declared as connection-scoped via `Connection`. No public exploit has been identified at time of analysis and exploitation is conditional on non-default origin behavior, limiting real-world priority despite the network-reachable attack vector.
Quadratic-complexity denial of service in Hono's `languageDetector` middleware (versions 4.12.0-4.12.33) allows unauthenticated remote attackers to exhaust CPU resources by sending HTTP requests with crafted language tags containing large numbers of hyphen-separated subtags. The default middleware configuration accepts language values from query parameters, cookies, and the Accept-Language header without authentication, meaning the vulnerable code path is reachable from the network in any default Hono deployment using this middleware. No public exploit code has been identified and this CVE is not in the CISA KEV catalog, but the attack is trivially constructible from the advisory description; the fix was released in version 4.12.34.
Credential inference via timing side-channel is possible in Hono before 4.11.10 when the built-in `basicAuth` or `bearerAuth` middlewares are in use, due to JavaScript's short-circuit `===` string equality operator being used inside the `timingSafeEqual` function for hash comparison. Because `===` terminates on the first differing character, response times vary slightly based on how many leading characters of a credential match the stored hash, enabling an attacker to recover credentials one character at a time through statistical timing analysis. No public exploit has been identified and the vendor GHSA advisory explicitly characterizes this as a hardening improvement with low practical exploitability outside highly controlled, low-jitter network environments.
Prototype pollution in Hono before 4.12.7 enables unauthenticated remote attackers to inject properties into JavaScript's Object.prototype by submitting crafted form field names containing '__proto__' keys when the 'dot' option is enabled in parseBody. Exploitation is conditional - it further requires that application code merges parsed body output into plain JavaScript objects using unsafe merge patterns - but when both conditions are present, attackers can silently alter inherited object behavior across the entire runtime, potentially bypassing authorization checks or leaking sensitive data. No public exploit code or CISA KEV listing exists at time of analysis; the CVSS 4.0 score of 6.3 reflects limited impact and the attack prerequisite of the non-default dot option being enabled.
Server-side rendering XSS in Hono's hono/css module (versions 4.0.0 through 4.12.26) allows injection of arbitrary HTML markup by exploiting the cx() function's failure to HTML-escape input before marking it as safe. When untrusted data flows into a cx() call used in a JSX class attribute during SSR, attackers can break out of the attribute context and inject arbitrary markup or script into the rendered page delivered to victims. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 6.1 Medium score with Scope:Changed reflects the cross-context server-to-browser impact.
Server-side rendering in Hono's JSX module (versions 4.11.8 through before 4.12.27) fails to isolate context values per request, enabling cross-request data leakage under concurrent load. When async components yield at an await boundary, the shared context store can be overwritten by a concurrent in-flight request, causing createContext, useContext, jsxRenderer, or useRequestContext data from one user's session to bleed into another user's response. No public exploit has been identified at time of analysis, but the C:H CVSS impact rating reflects that leaked context values frequently carry sensitive per-user material such as authentication state, session tokens, or profile data.
Header de-duplication logic in Hono's AWS API Gateway v1 adapter silently drops distinct repeated header values because it uses substring comparison rather than exact string equality, meaning a value like '10.0.0.1' would incorrectly suppress '10.0.0.10'. Middleware or application logic relying on a complete X-Forwarded-For chain, rate limiting counters, audit trail integrity, or proxy-chain trust validation receives a truncated view of the request. Affected versions span 4.3.3 through 4.12.26; no public exploit identified at time of analysis, though the GitHub advisory confirms the issue and a fix is released in v4.12.27.
Header injection in Hono's CORS middleware exposes applications to cache key pollution across versions before 4.10.3. When the CORS `origin` option is configured to anything other than wildcard `*`, the middleware incorrectly promotes client-supplied `Vary` header values from the incoming request directly into the HTTP response - a behavior violating the HTTP specification, which reserves `Vary` as a server-managed response header. In environments using shared caches, CDNs, or reverse proxies, an attacker can craft requests with arbitrary `Vary` values to poison cache entries, potentially causing incorrect CORS policies to be enforced for legitimate downstream users. No public exploit code and no CISA KEV listing have been identified at time of analysis.
HTML injection in Hono's JSX server-side rendering engine (versions before 4.12.14) allows network-accessible attackers to corrupt rendered HTML output by supplying malformed attribute names containing characters such as quotes or angle brackets. Applications that pass untrusted external input - query parameters, form data, or other user-controlled values - directly as JSX attribute keys during SSR are affected. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis; however, successful exploitation against vulnerable application patterns can escalate to cross-site scripting if the injected HTML includes event handlers processed by the victim's browser.
Missing cookie name validation on the write path in Hono's setCookie(), serialize(), and serializeSigned() functions allows user-controlled input containing CRLF control characters to produce malformed Set-Cookie headers. Affected are all Hono npm releases before 4.12.12. In practice, modern runtimes including Node.js and Cloudflare Workers reject the malformed headers before they are transmitted, meaning confirmed impact is availability loss (runtime errors crashing the response) rather than header injection or response splitting - though theoretical risk exists on less-strict runtimes. No active exploitation is confirmed, and no public exploit code has been identified.
Hono's jwt and jwk middleware components fail to enforce the Bearer scheme in the Authorization header, allowing any two-part header value - such as 'Basic <token>' or 'Token <token>' - to pass JWT verification identically to a correctly formed Bearer request. All Hono releases prior to 4.12.21 on any supported JavaScript runtime are affected when these middlewares protect routes. No public exploit identified at time of analysis, and this is not listed in CISA KEV; real-world exploitation requires the attacker to already possess a valid, properly signed JWT.
IP restriction bypass in Hono's ip-restriction middleware (hono/ip-restriction) prior to version 4.12.21 allows unauthenticated remote attackers to circumvent configured deny and allow rules by submitting non-canonical IPv6 representations of restricted addresses. String equality comparison applied after only partial normalization means that compressed, explicit-zero, or hex-notation IPv4-mapped IPv6 forms of a listed address silently fail to match the normalized rule entry, causing enforcement to be skipped entirely. No public exploit has been identified at time of analysis, but the bypass requires only trivial reformatting of a standard IPv6 address, making it practically low-effort for any attacker aware of the flaw.
HTTP response header injection in Hono's cookie serialize() function allows unauthenticated remote attackers to inject arbitrary Set-Cookie attributes when an application passes user-controlled input into the sameSite or priority cookie options. All Hono releases prior to 4.12.21 are affected across every supported JavaScript runtime. No public exploit code exists at time of analysis, and the vulnerability is not listed in CISA KEV, though the low attack complexity and network-accessible vector make it exploitable wherever the affected code path is reachable by user-supplied data.
Path prefix stripping in Hono's app.mount() API exposes mounted sub-applications to incorrect routing due to a raw-vs-decoded URL path inconsistency, potentially allowing unauthenticated remote attackers to reach unintended endpoints and disclose protected information. All Hono versions prior to 4.12.21 are affected across every supported JavaScript runtime. No public exploit or CISA KEV listing exists at time of analysis; however, the CVSS vector AV:N/AC:L/PR:N/UI:N and the 'Information Disclosure / Request Smuggling' classification make this a meaningful priority for any deployment that relies on mount-prefix path logic for access segregation.
Hono versions up to 4.12.4 contains a vulnerability that allows attackers to injection of additional cookie attributes if untrusted input was passed into the (CVSS 5.4).
Hono versions up to 4.12.4 contains a vulnerability that allows attackers to injection of additional SSE fields within the same event frame if untrusted inpu (CVSS 6.5).
Hono's ErrorBoundary JSX component before version 4.11.7 fails to properly sanitize user-controlled input, allowing attackers to inject and execute arbitrary JavaScript in victims' browsers through reflected XSS. The vulnerability requires user interaction and network access but can compromise the confidentiality and integrity of affected applications. A patch is available in version 4.11.7.
Hono versions before 4.11.7 contain an information disclosure vulnerability in the static file serving middleware for Cloudflare Workers that allows unauthenticated remote attackers to read sensitive environment keys through path traversal. The lack of proper input validation enables attackers to access internal asset keys that should remain protected. A patch is available in version 4.11.7 and later.
Hono versions up to 4.11.7 contains a vulnerability that allows attackers to private or authenticated responses being cached and subsequently exposed to unau (CVSS 5.3).
Hono's IP Restriction Middleware fails to properly validate IPv4 octet ranges, allowing attackers to bypass IP-based access controls by submitting malformed addresses with values exceeding 255. This affects all users relying on Hono's IP filtering mechanisms for authentication or authorization. A patch is available in version 4.11.7 and later.
Improper authorization in Hono's JWT Auth Middleware (hono/jwt in the npm package 'hono', versions 1.1.0 through 4.10.1) causes the API to accept a correctly signed token that was issued for a different audience, producing confused-deputy / token-mix-up behavior whenever multiple services share the same JWT issuer and signing key. Because the middleware exposed no aud verification option at all before 4.10.2 (documented options covered only iss/nbf/iat/exp), any such shared-key deployment was left unvalidated by default with no misconfiguration required; however, the attacker must already possess a valid, correctly signed token minted for another audience in the same trust domain, and a multi-service shared-key architecture must exist, so a fully anonymous outsider cannot exploit it. Public reporting is limited to the vendor GitHub advisory (which deliberately withholds reproduction steps) and the upstream fix commit, the EPSS score is low at 0.38% (30th percentile), there is no CISA KEV listing, and the vendor-released patch is Hono 4.10.2. Signals are mixed and point to a conditional, moderate real-world priority rather than a drop-everything emergency.
Hono is a Web application framework that provides support for any JavaScript runtime. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Hono is a Web application framework that provides support for any JavaScript runtime. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery (CSRF) middleware by a request without Content-Type header. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Hono is a Web application framework that provides support for any JavaScript runtime. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Hono is a Web application framework that provides support for any JavaScript runtime. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The adapter @hono/node-server allows you to run your Hono application on Node.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Hono is a web framework written in TypeScript. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.