hono
npm54 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting honopage 2 of 2
- CVE-2026-84363MEDIUMCVSS 5.9EG 5.9fixed in 4.13.52026-09-01
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read req…
- CVE-2026-84364MEDIUMCVSS 5.3EG 5.3fixed in 4.13.52026-09-01
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nes…
- CVE-2026-84365MEDIUMCVSS 6.5EG 6.5fixed in 4.13.52026-09-01
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG() can still write files outside the con…
- CVE-2026-93981MEDIUMCVSS 4.7EG 4.7fixed in 4.13.72026-09-19
hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root …
Check whether hono is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for hono CVEs against the assets you own.
Book a Demo →