# Hono vulnerabilities Source: https://junglewise.ai/threats/vendors/hono Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/hono.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 17 vulnerabilities in Hono: 7 in the last 7 days and 11 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126358, was published on 13 November 2026. 2 vulnerabilities in the last four weeks, level on the four before (2). 2 technologies have a page of their own. ## Counts - Last 7 days: 7 - Last 30 days: 8 - Last 90 days: 11 - All time: 17 (0 critical, 0 exploited in the wild) ## About Hono Hono is a web framework for building applications on various JavaScript runtimes. ## Latest Hono vulnerabilities - [CVE-2026-126358: Hono RegExpRouter middleware bypass via wildcard matching](https://junglewise.ai/threats/cve-2026-126358-hono-regexprouter-skips-wildcard-middleware-for-some-route-sets) (medium, CVSS 5.3, published 13 Nov 2026) - [CVE-2026-126357: Hono mount() path traversal bypasses middleware scoping](https://junglewise.ai/threats/cve-2026-126357-hono-mount-and-app-mount-can-forward-a-path-that-bypasses) (medium, CVSS 5.3, published 13 Nov 2026) - [CVE-2026-126356: Hono validator form multipart/form-data parameter bypass](https://junglewise.ai/threats/cve-2026-126356-hono-validator-form-skips-validation-for-multipart-form-data) (medium, CVSS 5.3, published 13 Nov 2026) - [CVE-2026-126355: Hono csrf() middleware bypass via hyperlink auditing](https://junglewise.ai/threats/cve-2026-126355-hono-csrf-does-not-check-requests-sent-by-hyperlink-auditing) (medium, CVSS 5.3, published 13 Nov 2026) - [CVE-2026-126344: @hono/node-server WebSocket upgrade host spoofing bypass](https://junglewise.ai/threats/cve-2026-126344-hono-node-server-allows-running-the-hono-application-on-node-js) (medium, CVSS 5.4, published 12 Nov 2026) - [CVE-2026-126343: @hono/node-server WebSocket ECONNRESET denial of service](https://junglewise.ai/threats/cve-2026-126343-hono-node-server-unhandled-econnreset-on-the-socket-during-an) (medium, CVSS 5.3, published 12 Nov 2026) - [CVE-2026-126210: @hono/node-server path traversal via backslash bypass](https://junglewise.ai/threats/cve-2026-126210-hono-node-server-backslash-in-the-request-path-is-parsed-as-a) (medium, CVSS 5.3, published 12 Nov 2026) - [CVE-2026-111757: Hono serveStatic authorization bypass via double percent-decoding](https://junglewise.ai/threats/cve-2026-111757-hono-is-a-web-application-framework-that-provides-support-for) (medium, CVSS 5.3, published 19 Oct 2026) - [CVE-2026-109955: Hono serveStatic middleware bypass via double decoding](https://junglewise.ai/threats/cve-2026-109955-hono-from-4-12-4-before-4-13-11-contains-a-middleware-bypass) (medium, CVSS 5.3, published 13 Oct 2026) - [hono/jsx unescaped string rendering in boundary components XSS](https://junglewise.ai/threats/duplicate-advisory-hono-jsx-renders-plain-strings-unescaped-in-boundary-4e550189) (medium, CVSS 4.7, published 19 Sep 2026) - [CVE-2026-93981: Hono JSX cross-site scripting in unescaped string rendering](https://junglewise.ai/threats/cve-2026-93981-hono-before-4-13-7-fails-to-html-escape-plain-strings-rendered-by) (medium, CVSS 4.7, published 19 Sep 2026) - [CVE-2026-56763: Hono prototype pollution in parseBody with dot option enabled](https://junglewise.ai/threats/cve-2026-56763-hono-prototype-pollution-in-parsebody-with-dot-option-enabled) (medium, CVSS 4.8, published 11 Jul 2026) - [CVE-2025-71381: Hono CORS middleware Vary header injection](https://junglewise.ai/threats/cve-2025-71381-hono-cors-middleware-vary-header-injection) (medium, CVSS 6.5, published 30 Jun 2026) - [CVE-2026-39406: Hono node-server middleware bypass in serveStatic](https://junglewise.ai/threats/cve-2026-39406-hono-node-server-middleware-bypass-in-servestatic) (medium, CVSS 5.3, published 8 Apr 2026) - [CVE-2026-29087: Hono node-server authorization bypass via encoded slashes](https://junglewise.ai/threats/cve-2026-29087-hono-node-server-authorization-bypass-via-encoded-slashes) (low, CVSS 3.1, published 4 Mar 2026) - [CVE-2025-62610: Hono JWT audience validation missing in middleware](https://junglewise.ai/threats/cve-2025-62610-hono-jwt-audience-validation-missing-in-middleware) (high, CVSS 8.1, published 22 Oct 2025) - [CVE-2024-23340: Hono node-server path traversal in URL handling](https://junglewise.ai/threats/cve-2024-23340-hono-node-server-path-traversal-in-url-handling) (low, CVSS 3.1, published 23 Jan 2024) ## Most severe Hono vulnerabilities - [CVE-2025-62610: Hono JWT audience validation missing in middleware](https://junglewise.ai/threats/cve-2025-62610-hono-jwt-audience-validation-missing-in-middleware) (high, CVSS 8.1, published 22 Oct 2025) - [CVE-2025-71381: Hono CORS middleware Vary header injection](https://junglewise.ai/threats/cve-2025-71381-hono-cors-middleware-vary-header-injection) (medium, CVSS 6.5, published 30 Jun 2026) - [CVE-2026-126344: @hono/node-server WebSocket upgrade host spoofing bypass](https://junglewise.ai/threats/cve-2026-126344-hono-node-server-allows-running-the-hono-application-on-node-js) (medium, CVSS 5.4, published 12 Nov 2026) - [CVE-2026-39406: Hono node-server middleware bypass in serveStatic](https://junglewise.ai/threats/cve-2026-39406-hono-node-server-middleware-bypass-in-servestatic) (medium, CVSS 5.3, published 8 Apr 2026) - [CVE-2026-109955: Hono serveStatic middleware bypass via double decoding](https://junglewise.ai/threats/cve-2026-109955-hono-from-4-12-4-before-4-13-11-contains-a-middleware-bypass) (medium, CVSS 5.3, published 13 Oct 2026) - [CVE-2026-111757: Hono serveStatic authorization bypass via double percent-decoding](https://junglewise.ai/threats/cve-2026-111757-hono-is-a-web-application-framework-that-provides-support-for) (medium, CVSS 5.3, published 19 Oct 2026) - [CVE-2026-126358: Hono RegExpRouter middleware bypass via wildcard matching](https://junglewise.ai/threats/cve-2026-126358-hono-regexprouter-skips-wildcard-middleware-for-some-route-sets) (medium, CVSS 5.3, published 13 Nov 2026) - [CVE-2026-126357: Hono mount() path traversal bypasses middleware scoping](https://junglewise.ai/threats/cve-2026-126357-hono-mount-and-app-mount-can-forward-a-path-that-bypasses) (medium, CVSS 5.3, published 13 Nov 2026) - [CVE-2026-126356: Hono validator form multipart/form-data parameter bypass](https://junglewise.ai/threats/cve-2026-126356-hono-validator-form-skips-validation-for-multipart-form-data) (medium, CVSS 5.3, published 13 Nov 2026) - [CVE-2026-126355: Hono csrf() middleware bypass via hyperlink auditing](https://junglewise.ai/threats/cve-2026-126355-hono-csrf-does-not-check-requests-sent-by-hyperlink-auditing) (medium, CVSS 5.3, published 13 Nov 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, level on the four before (2). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 2 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 7 | 0 | 0 | ## Hono technologies - [Hono](https://junglewise.ai/threats/technologies/hono-hono): 11 vulnerabilities - [Hono Node-Server](https://junglewise.ai/threats/technologies/node-server): 6 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Hono vulnerabilities", https://junglewise.ai/threats/vendors/hono, 13 November 2026.