{"schema_version":1,"title":"hono (npm) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 54 vulnerabilities in hono (npm): 0 in the last 7 days and 13 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-84365, was published on 1 September 2026.","url":"https://junglewise.ai/threats/technologies/hono","json_url":"https://junglewise.ai/threats/technologies/hono.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/hono","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":2,"all_time":54,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":3,"last_90_days":13,"last_365_days":48},"latest":[{"cve":"CVE-2026-84365","cvss":6.5,"epss":0.0044,"slug":"cve-2026-84365-hono-tossg-path-traversal-with-consecutive-parent-directory","title":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-20","severity":"medium","exploited":false,"published_at":"2026-09-01T21:18:47.45+00:00","url":"https://junglewise.ai/threats/cve-2026-84365-hono-tossg-path-traversal-with-consecutive-parent-directory"},{"cve":"CVE-2026-84364","cvss":5.3,"epss":0.0053,"slug":"cve-2026-84364-hono-parsebody-memory-exhaustion-with-unbounded-dot-notation","title":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separate","severity":"medium","exploited":false,"published_at":"2026-09-01T21:18:47.317+00:00","url":"https://junglewise.ai/threats/cve-2026-84364-hono-parsebody-memory-exhaustion-with-unbounded-dot-notation"},{"cve":"CVE-2026-84363","cvss":5.9,"epss":0.0045,"slug":"cve-2026-84363-hono-query-parser-fragment-interpretation-differential","title":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question","severity":"medium","exploited":false,"published_at":"2026-09-01T21:18:47.173+00:00","url":"https://junglewise.ai/threats/cve-2026-84363-hono-query-parser-fragment-interpretation-differential"},{"cve":"CVE-2026-71850","cvss":4.8,"epss":0.0027,"slug":"cve-2026-71850-hono-hono-jsx-cross-user-data-disclosure-in-memo-function","title":"Hono hono/jsx cross-user data disclosure in memo function","severity":"medium","exploited":false,"published_at":"2026-08-07T18:42:01+00:00","url":"https://junglewise.ai/threats/cve-2026-71850-hono-hono-jsx-cross-user-data-disclosure-in-memo-function"},{"cve":"CVE-2026-71849","cvss":3.7,"epss":0.0036,"slug":"cve-2026-71849-hono-proxy-helper-information-disclosure-via-hop-by-hop-headers","title":"Hono Proxy Helper information disclosure via hop-by-hop headers","severity":"low","exploited":false,"published_at":"2026-08-07T18:38:48+00:00","url":"https://junglewise.ai/threats/cve-2026-71849-hono-proxy-helper-information-disclosure-via-hop-by-hop-headers"},{"cve":"CVE-2026-71848","cvss":5.3,"epss":0.0051,"slug":"cve-2026-71848-hono-languagedetector-algorithmic-complexity-dos","title":"Hono languageDetector algorithmic complexity DoS","severity":"medium","exploited":false,"published_at":"2026-08-07T18:36:31+00:00","url":"https://junglewise.ai/threats/cve-2026-71848-hono-languagedetector-algorithmic-complexity-dos"},{"cve":"CVE-2026-69207","cvss":5.3,"epss":0.0061,"slug":"cve-2026-69207-hono-redos-in-cors-middleware-via-access-control-request-headers","title":"Hono ReDoS in CORS middleware via Access-Control-Request-Headers","severity":"medium","exploited":false,"published_at":"2026-08-03T20:23:30+00:00","url":"https://junglewise.ai/threats/cve-2026-69207-hono-redos-in-cors-middleware-via-access-control-request-headers"},{"cve":"CVE-2026-56764","cvss":3.7,"epss":0.003,"slug":"cve-2026-56764-hono-timing-attack-in-basicauth-and-bearerauth-middlewares","title":"Hono timing attack in basicAuth and bearerAuth middlewares","severity":"low","exploited":false,"published_at":"2026-07-15T12:18:15.44+00:00","url":"https://junglewise.ai/threats/cve-2026-56764-hono-timing-attack-in-basicauth-and-bearerauth-middlewares"},{"cve":"CVE-2026-56763","cvss":4.8,"epss":0.0027,"slug":"cve-2026-56763-hono-prototype-pollution-in-parsebody-with-dot-option-enabled","title":"Hono prototype pollution in parseBody with dot option enabled","severity":"medium","exploited":false,"published_at":"2026-07-11T14:16:22.08+00:00","url":"https://junglewise.ai/threats/cve-2026-56763-hono-prototype-pollution-in-parsebody-with-dot-option-enabled"},{"cve":"CVE-2026-59897","cvss":4.8,"epss":0.0018,"slug":"cve-2026-59897-hono-incorrect-header-de-duplication-in-aws-api-gateway-adapter","title":"Hono incorrect header de-duplication in AWS API Gateway adapter","severity":"medium","exploited":false,"published_at":"2026-07-08T17:17:27.637+00:00","url":"https://junglewise.ai/threats/cve-2026-59897-hono-incorrect-header-de-duplication-in-aws-api-gateway-adapter"},{"cve":"CVE-2026-59896","cvss":6.5,"epss":0.003,"slug":"cve-2026-59896-hono-race-condition-in-jsx-server-side-rendering-context","title":"Hono race condition in JSX server-side rendering context isolation","severity":"medium","exploited":false,"published_at":"2026-07-08T17:17:27.493+00:00","url":"https://junglewise.ai/threats/cve-2026-59896-hono-race-condition-in-jsx-server-side-rendering-context"},{"cve":"CVE-2026-59895","cvss":6.1,"epss":0.0033,"slug":"cve-2026-59895-hono-xss-in-hono-css-cx-utility","title":"Hono XSS in hono/css cx() utility","severity":"medium","exploited":false,"published_at":"2026-07-08T17:17:27.353+00:00","url":"https://junglewise.ai/threats/cve-2026-59895-hono-xss-in-hono-css-cx-utility"},{"cve":"CVE-2025-71381","cvss":6.5,"epss":0.0029,"slug":"cve-2025-71381-hono-cors-middleware-vary-header-injection","title":"Hono CORS middleware Vary header injection","severity":"medium","exploited":false,"published_at":"2026-06-30T23:16:52.027+00:00","url":"https://junglewise.ai/threats/cve-2025-71381-hono-cors-middleware-vary-header-injection"},{"cve":"CVE-2026-56761","cvss":4.3,"epss":0.0029,"slug":"cve-2026-56761-hono-html-injection-in-jsx-server-side-rendering","title":"Hono HTML injection in JSX server-side rendering","severity":"medium","exploited":false,"published_at":"2026-06-24T13:16:37.043+00:00","url":"https://junglewise.ai/threats/cve-2026-56761-hono-html-injection-in-jsx-server-side-rendering"},{"cvss":3.1,"slug":"hono-missing-validation-of-cookie-name-in-setcookie-6be42013","title":"Hono missing validation of cookie name in setCookie()","severity":"low","exploited":false,"published_at":"2026-06-23T15:32:37+00:00","url":"https://junglewise.ai/threats/hono-missing-validation-of-cookie-name-in-setcookie-6be42013"},{"cvss":5.3,"slug":"hono-missing-validation-of-cookie-name-in-setcookie-db78c038","title":"Hono missing validation of cookie name in setCookie()","severity":"medium","exploited":false,"published_at":"2026-06-23T15:32:37+00:00","url":"https://junglewise.ai/threats/hono-missing-validation-of-cookie-name-in-setcookie-db78c038"},{"cve":"CVE-2026-56762","cvss":5.3,"epss":0.0042,"slug":"cve-2026-56762-hono-missing-cookie-name-validation-in-setcookie","title":"Hono missing cookie name validation in setCookie","severity":"medium","exploited":false,"published_at":"2026-06-23T13:16:46.813+00:00","url":"https://junglewise.ai/threats/cve-2026-56762-hono-missing-cookie-name-validation-in-setcookie"},{"cve":"CVE-2026-54288","cvss":6.5,"epss":0.0015,"slug":"cve-2026-54288-hono-body-limit-middleware-bypass-on-aws-lambda","title":"Hono Body Limit Middleware bypass on AWS Lambda","severity":"medium","exploited":false,"published_at":"2026-06-22T19:17:19.553+00:00","url":"https://junglewise.ai/threats/cve-2026-54288-hono-body-limit-middleware-bypass-on-aws-lambda"},{"cve":"CVE-2026-54290","cvss":7.1,"epss":0.0033,"slug":"cve-2026-54290-hono-permissive-cors-policy-in-cors-middleware","title":"Hono permissive CORS policy in CORS Middleware","severity":"high","exploited":false,"published_at":"2026-06-22T18:16:47.62+00:00","url":"https://junglewise.ai/threats/cve-2026-54290-hono-permissive-cors-policy-in-cors-middleware"},{"cve":"CVE-2026-54289","cvss":4.8,"epss":0.0018,"slug":"cve-2026-54289-hono-header-truncation-in-aws-lambda-edge-adapter","title":"Hono header truncation in AWS Lambda@Edge adapter","severity":"medium","exploited":false,"published_at":"2026-06-22T18:16:47.48+00:00","url":"https://junglewise.ai/threats/cve-2026-54289-hono-header-truncation-in-aws-lambda-edge-adapter"},{"cve":"CVE-2026-54287","cvss":5.3,"epss":0.0031,"slug":"cve-2026-54287-hono-improper-cookie-header-merging-in-aws-lambda-adapter","title":"Hono improper cookie header merging in AWS Lambda adapter","severity":"medium","exploited":false,"published_at":"2026-06-22T18:16:47.35+00:00","url":"https://junglewise.ai/threats/cve-2026-54287-hono-improper-cookie-header-merging-in-aws-lambda-adapter"},{"cve":"CVE-2026-54286","cvss":5.9,"epss":0.0043,"slug":"cve-2026-54286-hono-path-traversal-in-serve-static-on-windows","title":"Hono path traversal in serve-static on Windows","severity":"medium","exploited":false,"published_at":"2026-06-22T18:16:47.213+00:00","url":"https://junglewise.ai/threats/cve-2026-54286-hono-path-traversal-in-serve-static-on-windows"},{"cve":"CVE-2026-47676","cvss":5.3,"epss":0.0033,"slug":"cve-2026-47676-hono-incorrect-path-stripping-in-app-mount","title":"Hono incorrect path stripping in app.mount","severity":"medium","exploited":false,"published_at":"2026-05-28T17:16:32.697+00:00","url":"https://junglewise.ai/threats/cve-2026-47676-hono-incorrect-path-stripping-in-app-mount"},{"cve":"CVE-2026-47675","cvss":4.3,"epss":0.0028,"slug":"cve-2026-47675-hono-set-cookie-injection-in-cookie-serialization","title":"Hono Set-Cookie injection in cookie serialization","severity":"medium","exploited":false,"published_at":"2026-05-28T17:16:32.537+00:00","url":"https://junglewise.ai/threats/cve-2026-47675-hono-set-cookie-injection-in-cookie-serialization"},{"cve":"CVE-2026-47674","cvss":5.3,"epss":0.0031,"slug":"cve-2026-47674-hono-ip-restriction-middleware-ip-restriction-bypass-via-non","title":"Hono ip-restriction middleware IP restriction bypass via non-canonical IPv6","severity":"medium","exploited":false,"published_at":"2026-05-28T17:16:32.383+00:00","url":"https://junglewise.ai/threats/cve-2026-47674-hono-ip-restriction-middleware-ip-restriction-bypass-via-non"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"flowise (npm)","slug":"flowise","vulnerabilities":156,"url":"https://junglewise.ai/threats/technologies/flowise"},{"name":"vm2 (npm)","slug":"vm2","vulnerabilities":83,"url":"https://junglewise.ai/threats/technologies/vm2"},{"name":"@budibase/server (npm)","slug":"budibase-server","vulnerabilities":61,"url":"https://junglewise.ai/threats/technologies/budibase-server"},{"name":"directus (npm)","slug":"directus","vulnerabilities":60,"url":"https://junglewise.ai/threats/technologies/directus"},{"name":"nocodb (npm)","slug":"nocodb","vulnerabilities":55,"url":"https://junglewise.ai/threats/technologies/nocodb"},{"name":"parse-server (npm)","slug":"parse-server","vulnerabilities":42,"url":"https://junglewise.ai/threats/technologies/parse-server"},{"name":"dompurify (npm)","slug":"dompurify","vulnerabilities":39,"url":"https://junglewise.ai/threats/technologies/dompurify"},{"name":"ghost (npm)","slug":"ghost","vulnerabilities":39,"url":"https://junglewise.ai/threats/technologies/ghost"},{"name":"flowise-components (npm)","slug":"flowise-components","vulnerabilities":35,"url":"https://junglewise.ai/threats/technologies/flowise-components"},{"name":"astro (npm)","slug":"astro","vulnerabilities":30,"url":"https://junglewise.ai/threats/technologies/astro"},{"name":"@anthropic-ai/claude-code (npm)","slug":"anthropic-ai-claude-code","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/anthropic-ai-claude-code"},{"name":"9router (npm)","slug":"9router","vulnerabilities":26,"url":"https://junglewise.ai/threats/technologies/9router"}],"technology":{"hub":true,"name":"hono (npm)","slug":"hono","vendor":{"name":"npm","slug":"npm","url":"https://junglewise.ai/threats/vendors/npm"},"aliases":[],"homepage":"https://hono.dev/","repo_url":"https://github.com/honojs/hono","description":"A small, fast, web framework for Edges, such as Cloudflare Workers, Fastly Compute, and Deno.","url":"https://junglewise.ai/threats/technologies/hono"},"most_severe":[{"cve":"CVE-2026-39408","cvss":7.5,"epss":0.0045,"slug":"cve-2026-39408-hono-path-traversal-in-tossg-during-static-site-generation","title":"Hono path traversal in toSSG during static site generation","severity":"high","exploited":false,"published_at":"2026-04-08T15:16:14.823+00:00","url":"https://junglewise.ai/threats/cve-2026-39408-hono-path-traversal-in-tossg-during-static-site-generation"},{"cve":"CVE-2026-54290","cvss":7.1,"epss":0.0033,"slug":"cve-2026-54290-hono-permissive-cors-policy-in-cors-middleware","title":"Hono permissive CORS policy in CORS Middleware","severity":"high","exploited":false,"published_at":"2026-06-22T18:16:47.62+00:00","url":"https://junglewise.ai/threats/cve-2026-54290-hono-permissive-cors-policy-in-cors-middleware"},{"cve":"CVE-2026-84365","cvss":6.5,"epss":0.0044,"slug":"cve-2026-84365-hono-tossg-path-traversal-with-consecutive-parent-directory","title":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-20","severity":"medium","exploited":false,"published_at":"2026-09-01T21:18:47.45+00:00","url":"https://junglewise.ai/threats/cve-2026-84365-hono-tossg-path-traversal-with-consecutive-parent-directory"},{"cve":"CVE-2026-59896","cvss":6.5,"epss":0.003,"slug":"cve-2026-59896-hono-race-condition-in-jsx-server-side-rendering-context","title":"Hono race condition in JSX server-side rendering context isolation","severity":"medium","exploited":false,"published_at":"2026-07-08T17:17:27.493+00:00","url":"https://junglewise.ai/threats/cve-2026-59896-hono-race-condition-in-jsx-server-side-rendering-context"},{"cve":"CVE-2025-71381","cvss":6.5,"epss":0.0029,"slug":"cve-2025-71381-hono-cors-middleware-vary-header-injection","title":"Hono CORS middleware Vary header injection","severity":"medium","exploited":false,"published_at":"2026-06-30T23:16:52.027+00:00","url":"https://junglewise.ai/threats/cve-2025-71381-hono-cors-middleware-vary-header-injection"},{"cve":"CVE-2026-44456","cvss":6.5,"epss":0.0028,"slug":"cve-2026-44456-hono-bodylimit-bypass-for-chunked-requests","title":"Hono bodyLimit bypass for chunked requests","severity":"medium","exploited":false,"published_at":"2026-05-13T16:16:57.567+00:00","url":"https://junglewise.ai/threats/cve-2026-44456-hono-bodylimit-bypass-for-chunked-requests"},{"cve":"CVE-2026-54288","cvss":6.5,"epss":0.0015,"slug":"cve-2026-54288-hono-body-limit-middleware-bypass-on-aws-lambda","title":"Hono Body Limit Middleware bypass on AWS Lambda","severity":"medium","exploited":false,"published_at":"2026-06-22T19:17:19.553+00:00","url":"https://junglewise.ai/threats/cve-2026-54288-hono-body-limit-middleware-bypass-on-aws-lambda"},{"cve":"CVE-2026-59895","cvss":6.1,"epss":0.0033,"slug":"cve-2026-59895-hono-xss-in-hono-css-cx-utility","title":"Hono XSS in hono/css cx() utility","severity":"medium","exploited":false,"published_at":"2026-07-08T17:17:27.353+00:00","url":"https://junglewise.ai/threats/cve-2026-59895-hono-xss-in-hono-css-cx-utility"},{"cve":"CVE-2026-84363","cvss":5.9,"epss":0.0045,"slug":"cve-2026-84363-hono-query-parser-fragment-interpretation-differential","title":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question","severity":"medium","exploited":false,"published_at":"2026-09-01T21:18:47.173+00:00","url":"https://junglewise.ai/threats/cve-2026-84363-hono-query-parser-fragment-interpretation-differential"},{"cve":"CVE-2026-54286","cvss":5.9,"epss":0.0043,"slug":"cve-2026-54286-hono-path-traversal-in-serve-static-on-windows","title":"Hono path traversal in serve-static on Windows","severity":"medium","exploited":false,"published_at":"2026-06-22T18:16:47.213+00:00","url":"https://junglewise.ai/threats/cve-2026-54286-hono-path-traversal-in-serve-static-on-windows"}],"generated_at":"2026-09-27T03:07:00.185062+00:00"}