Hono

Hono versions up to 4.12.4 contains a vulnerability that allows attackers to injection of additional cookie attributes if untrusted input was passed into the (CVSS 5.4).

Hono versions up to 4.12.4 contains a vulnerability that allows attackers to injection of additional SSE fields within the same event frame if untrusted inpu (CVSS 6.5).

Hono versions prior to 4.12.4 suffer from an authentication bypass in serveStatic when combined with route-based middleware protections due to inconsistent URL decoding between the router and file serving components. An unauthenticated remote attacker can exploit this mismatch by encoding slashes (%2F) in request paths to access protected static resources that should be restricted by middleware rules. A patch is available in version 4.12.4 and later.

Hono is a Web application framework that provides support for any JavaScript runtime. [CVSS 8.2 HIGH]

Hono's ErrorBoundary JSX component before version 4.11.7 fails to properly sanitize user-controlled input, allowing attackers to inject and execute arbitrary JavaScript in victims' browsers through reflected XSS. The vulnerability requires user interaction and network access but can compromise the confidentiality and integrity of affected applications. A patch is available in version 4.11.7.

Hono versions before 4.11.7 contain an information disclosure vulnerability in the static file serving middleware for Cloudflare Workers that allows unauthenticated remote attackers to read sensitive environment keys through path traversal. The lack of proper input validation enables attackers to access internal asset keys that should remain protected. A patch is available in version 4.11.7 and later.

Hono versions up to 4.11.7 contains a vulnerability that allows attackers to private or authenticated responses being cached and subsequently exposed to unau (CVSS 5.3).

Hono's IP Restriction Middleware fails to properly validate IPv4 octet ranges, allowing attackers to bypass IP-based access controls by submitting malformed addresses with values exceeding 255. This affects all users relying on Hono's IP filtering mechanisms for authentication or authorization. A patch is available in version 4.11.7 and later.

Hono versions before 4.11.4 allow JWT algorithm confusion attacks through improper algorithm validation in the JWK/JWKS verification middleware, enabling attackers to forge valid tokens when the selected JWK lacks an explicit algorithm definition. An unauthenticated remote attacker can exploit this to bypass JWT signature verification and gain unauthorized access to affected applications. The vulnerability has been patched in version 4.11.4, which now requires explicit algorithm allowlists instead of deriving algorithms from untrusted JWT headers.

Hono before version 4.11.4 contains a JWT algorithm confusion vulnerability in its JWK/JWKS verification middleware that allows attackers to forge authentication tokens when the JWK lacks explicit algorithm specification. An unauthenticated remote attacker can exploit this by manipulating the JWT header's alg value to bypass signature verification in affected configurations. The vulnerability is resolved in version 4.11.4, which now requires explicit algorithm specification to prevent header-driven algorithm confusion.

Hono is a Web application framework that provides support for any JavaScript runtime. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

Hono is a Web application framework that provides support for any JavaScript runtime. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.