honojs/hono Security Advisories | GitStock

medium2026-01-27

Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception

GHSA-6wqw-2p9w-4vw4 · CVE-2026-24472

medium2026-01-27

Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing

GHSA-r354-f388-2fhh · CVE-2026-24398

high2026-01-13

Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)

GHSA-3vhc-576x-3qv4 · CVE-2026-22818

high2026-01-13

Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass

GHSA-f67f-6cw9-8mq4 · CVE-2026-22817

medium2025-10-24

Hono vulnerable to Vary Header Injection leading to potential CORS Bypass

GHSA-q7jf-gf43-6x6p · CVE-2025-71381

high2025-10-22

Hono Improper Authorization vulnerability

GHSA-m732-5p4w-x69g · CVE-2025-62610

medium2025-09-12

Hono has Body Limit Middleware Bypass

GHSA-92vj-g62v-jqhh · CVE-2025-59139

high2025-09-03

Hono's flaw in URL path parsing could cause path confusion

GHSA-9hp6-4448-45g2 · CVE-2025-58362

medium2024-10-15

Hono allows bypass of CSRF Middleware by a request without Content-Type header.

GHSA-2234-fmw7-43wr · CVE-2024-48913

low2024-08-22

Hono CSRF middleware can be bypassed using crafted Content-Type header

GHSA-rpfr-3m35-5vx5 · CVE-2024-43787

medium2024-04-23

Hono vulnerable to Restricted Directory Traversal in serveStatic with deno

GHSA-3mpf-rcc7-5347 · CVE-2024-32869

medium2023-12-15

Named path parameters can be overridden in TrieRouter

GHSA-f6gv-hh8j-q8vq · CVE-2023-50710