hono

4.13.13 · 4 Oct 2026MIT45.2M / weekRepository Homepage npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Is your project affected?

Paste your package.json, or type the range you declare for hono. It is read in your browser and sent nowhere.

Line	Newest	Where it stands
	4.13.13	Safe from 4.13.11
	3.12.12	372 open advisories, worst high · last release Feb 2024, no longer updated

Your version

High
hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcardGHSA-88fw-hqm2-52qc · 16 Jun 2026
- 4.x4.0.0 – 4.12.24Fixed in 4.12.25
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.25
High
Hono vulnerable to arbitrary file access via serveStatic vulnerability GHSA-q5qw-h33p-qvwr · 4 Mar 2026
- 4.x4.0.0 – 4.12.3Fixed in 4.12.4
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.4
High
Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfoGHSA-xh87-mx6m-69f3 · 25 Feb 2026
- 4.x4.12.0 – 4.12.1Fixed in 4.12.2
High
Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)GHSA-3vhc-576x-3qv4 · 13 Jan 2026
- 4.x4.0.0 – 4.11.3Fixed in 4.11.4
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.11.4
High
Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth BypassGHSA-f67f-6cw9-8mq4 · 13 Jan 2026
- 4.x4.0.0 – 4.11.3Fixed in 4.11.4
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.11.4
High
Hono Improper Authorization vulnerabilityGHSA-m732-5p4w-x69g · 22 Oct 2025
- 4.x4.0.0 – 4.10.1Fixed in 4.10.2
- 3.x and older1.1.0 – 3.12.12No fix, no longer updated · move to 4.10.2
High
Hono's flaw in URL path parsing could cause path confusionGHSA-9hp6-4448-45g2 · 3 Sept 2025
- 4.x4.8.0 – 4.9.5Fixed in 4.9.6
Moderate
Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathsGHSA-5r4p-p66f-jhc7 · 20 Oct 2026
- 4.x4.12.4 – 4.13.10Fixed in 4.13.11
Moderate
hono/jsx renders plain strings unescaped in boundary components, leading to XSSGHSA-hxh3-vqpv-xpqv · 30 Sept 2026
- 4.x4.0.0 – 4.13.6Fixed in 4.13.7
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.13.7
Moderate
Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directoryGHSA-gqvv-2mrq-wpjv · 8 Sept 2026
- 4.x4.0.0 – 4.13.4Fixed in 4.13.5
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.13.5
Moderate
Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustionGHSA-g6gw-c38x-mqfc · 8 Sept 2026
- 4.x4.0.0 – 4.13.4Fixed in 4.13.5
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.13.5
Moderate
Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentialsGHSA-crvj-82cr-hjcx · 8 Sept 2026
- 4.x4.0.0 – 4.13.4Fixed in 4.13.5
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.13.5
Moderate
Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosureGHSA-f23p-vx2j-j53r · 7 Aug 2026
- 4.x4.0.0 – 4.12.33Fixed in 4.12.34
- 3.x3.8.0 – 3.12.12No fix on 3.x · move to 4.12.34
Moderate
Hono: Algorithmic Complexity DoS in Language MiddlewareGHSA-54fx-42gc-7vw4 · 7 Aug 2026
- 4.x4.12.0 – 4.12.33Fixed in 4.12.34
Moderate
Hono: ReDoS in CORS middleware via Access-Control-Request-HeadersGHSA-8j4g-w8fx-2239 · 3 Aug 2026
- 4.x4.0.0 – 4.12.33Fixed in 4.12.34
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.34
Moderate
hono/jsx does not isolate context per request, leading to cross-request data disclosureGHSA-hvrm-45r6-mjfj · 21 Jul 2026
- 4.x4.11.8 – 4.12.26Fixed in 4.12.27
Moderate
Hono: Server-Side XSS via JSX Escaping Bypass in cx() UtilityGHSA-w62v-xxxg-mg59 · 21 Jul 2026
- 4.x4.0.0 – 4.12.26Fixed in 4.12.27
Moderate
Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplicationGHSA-xgm2-5f3f-mvvc · 21 Jul 2026
- 4.x4.3.3 – 4.12.26Fixed in 4.12.27
Moderate
hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`GHSA-rv63-4mwf-qqc2 · 16 Jun 2026
- 4.x4.0.0 – 4.12.24Fixed in 4.12.25
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.25
Moderate
hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the restGHSA-wgpf-jwqj-8h8p · 16 Jun 2026
- 4.x4.0.0 – 4.12.24Fixed in 4.12.25
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.25
Moderate
hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)GHSA-wwfh-h76j-fc44 · 16 Jun 2026
- 4.x4.0.0 – 4.12.24Fixed in 4.12.25
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.25
Moderate
hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and LatticeGHSA-j6c9-x7qj-28xf · 16 Jun 2026
- 4.x4.0.0 – 4.12.24Fixed in 4.12.25
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.25
Moderate
Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded pathsGHSA-2gcr-mfcq-wcc3 · 4 Jun 2026
- 4.x4.0.0 – 4.12.20Fixed in 4.12.21
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.21
Moderate
Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 GHSA-xrhx-7g5j-rcj5 · 4 Jun 2026
- 4.x4.0.0 – 4.12.20Fixed in 4.12.21
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.21
Moderate
Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injectionGHSA-3hrh-pfw6-9m5x · 4 Jun 2026
- 4.x4.0.0 – 4.12.20Fixed in 4.12.21
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.21
Moderate
Hono: JWT middleware accepts any Authorization scheme, not only BearerGHSA-f577-qrjj-4474 · 4 Jun 2026
- 4.x4.0.0 – 4.12.20Fixed in 4.12.21
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.21
Moderate
Hono has CSS Declaration Injection via Style Object Values in JSX SSRGHSA-qp7p-654g-cw7p · 9 May 2026
- 4.x4.0.0 – 4.12.17Fixed in 4.12.18
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.18
Moderate
Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakageGHSA-p77w-8qqv-26rm · 9 May 2026
- 4.x4.0.0 – 4.12.17Fixed in 4.12.18
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.18
Moderate
Hono: bodyLimit() can be bypassed for chunked / unknown-length requestsGHSA-9vqf-7f2p-gf9v · 6 May 2026
- 4.x4.0.0 – 4.12.15Fixed in 4.12.16
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.16
Moderate
hono/jsx has Unvalidated JSX Tag Names that May Allow HTML InjectionGHSA-69xw-7hcm-h432 · 6 May 2026
- 4.x4.0.0 – 4.12.15Fixed in 4.12.16
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.16
Moderate
hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSRGHSA-458j-xx4x-4375 · 16 Apr 2026
- 4.x4.0.0 – 4.12.13Fixed in 4.12.14
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.14
Moderate
Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()GHSA-r5rp-j6wh-rvv4 · 8 Apr 2026
- 4.x4.0.0 – 4.12.11Fixed in 4.12.12
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.12
Moderate
Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addressesGHSA-xpcf-pg52-r92g · 8 Apr 2026
- 4.x4.0.0 – 4.12.11Fixed in 4.12.12
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.12
Moderate
Hono missing validation of cookie name on write path in setCookie()GHSA-26pp-8wgv-hjvm · 8 Apr 2026
- 4.x4.0.0 – 4.12.11Fixed in 4.12.12
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.12
Moderate
Hono: Path traversal in toSSG() allows writing files outside the output directoryGHSA-xf4j-xp2r-rqqx · 8 Apr 2026
- 4.x4.0.0 – 4.12.11Fixed in 4.12.12
Moderate
Hono: Middleware bypass via repeated slashes in serveStaticGHSA-wmmm-f939-6g9c · 8 Apr 2026
- 4.x4.0.0 – 4.12.11Fixed in 4.12.12
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.12
Moderate
Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })GHSA-v8w9-8mx6-g223 · 11 Mar 2026
- 4.x4.0.0 – 4.12.6Fixed in 4.12.7
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.7
Moderate
Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()GHSA-5pq2-9x2x-5p6w · 4 Mar 2026
- 4.x4.0.0 – 4.12.3Fixed in 4.12.4
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.4
Moderate
Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()GHSA-p6xx-57qc-3wxr · 4 Mar 2026
- 4.x4.0.0 – 4.12.3Fixed in 4.12.4
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.4
Moderate
Hono vulnerable to XSS through ErrorBoundary component GHSA-9r54-q6cx-xmh5 · 28 Jan 2026
- 4.x4.0.0 – 4.11.6Fixed in 4.11.7
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.11.7
Moderate
Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)GHSA-w332-q679-j88p · 27 Jan 2026
- 4.x4.0.0 – 4.11.6Fixed in 4.11.7
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.11.7
Moderate
Hono cache middleware ignores "Cache-Control: private" leading to Web Cache DeceptionGHSA-6wqw-2p9w-4vw4 · 27 Jan 2026
- 4.x4.0.0 – 4.11.6Fixed in 4.11.7
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.11.7
Moderate
Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofingGHSA-r354-f388-2fhh · 27 Jan 2026
- 4.x4.0.0 – 4.11.6Fixed in 4.11.7
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.11.7
Moderate
Hono vulnerable to Vary Header Injection leading to potential CORS BypassGHSA-q7jf-gf43-6x6p · 24 Oct 2025
- 4.x4.0.0 – 4.10.2Fixed in 4.10.3
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.10.3
Moderate
Hono has Body Limit Middleware BypassGHSA-92vj-g62v-jqhh · 12 Sept 2025
- 4.x4.0.0 – 4.9.6Fixed in 4.9.7
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.9.7
Moderate
Hono allows bypass of CSRF Middleware by a request without Content-Type header.GHSA-2234-fmw7-43wr · 15 Oct 2024
- 4.x4.0.0 – 4.6.4Fixed in 4.6.5
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.6.5
Moderate
Hono vulnerable to Restricted Directory Traversal in serveStatic with denoGHSA-3mpf-rcc7-5347 · 23 Apr 2024
- 4.x4.0.0 – 4.2.6Fixed in 4.2.7
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.2.7
Moderate
Named path parameters can be overridden in TrieRouterGHSA-f6gv-hh8j-q8vq · 15 Dec 2023
- 3.x3.0.0 – 3.11.6Fixed in 3.11.7
- 2.x and older0.0.1 – 2.7.8No fix, no longer updated · move to 3.11.7
Low
Hono: Proxy Helper does not remove response headers listed in the `Connection` headerGHSA-79qm-7rj5-m7r9 · 7 Aug 2026
- 4.x4.7.0 – 4.12.33Fixed in 4.12.34
Low
Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()GHSA-hm8q-7f3q-5f36 · 9 May 2026
- 4.x4.0.0 – 4.12.17Fixed in 4.12.18
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.12.18
Low
Hono added timing comparison hardening in basicAuth and bearerAuthGHSA-gq3j-xvxp-8hrf · 19 Feb 2026
- 4.x4.0.0 – 4.11.9Fixed in 4.11.10
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.11.10
Low
Hono CSRF middleware can be bypassed using crafted Content-Type headerGHSA-rpfr-3m35-5vx5 · 22 Aug 2024
- 4.x4.0.0 – 4.5.7Fixed in 4.5.8
- 3.x and older0.0.1 – 3.12.12No fix, no longer updated · move to 4.5.8

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 20 October 2026. Releases and advisories last read 20 October 2026.