Packages / hono / Security

HighVulnerabilityGHSA-xh87-mx6m-69f3Published 25 Feb 2026

Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo

Affected releases · hono

  • 4.x4.12.0 – 4.12.1Fixed in 4.12.2

On 4.x, the newest line:

npm install hono@4.12.2

  1. Not affected

    0.0.1 – 4.11.10

    361 releases

  2. Affected

    4.12.0 – 4.12.1

    2 releases

  3. Fixed

    4.12.2 – 4.13.13

    47 releases, latest

410 stable releases of hono, oldest to newest.

Is your project affected?

Paste your package.json, or type the range you declare for hono. It is read in your browser and sent nowhere.

What happens

The full text is not stored yet. Read it on osv.dev.