Skip to content
OpenAdvisories

Package · npm

hono

52 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-71849

    Hono: Proxy Helper does not remove response headers listed in the `Connection` header

    Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy() function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, …

    honojs hono langfuse-3-worker langfuse-3-compat Wolfi npm
  • Low 3.7
    CVE-2026-56764

    Hono - Timing Attack in basicAuth and bearerAuth Middleware

    Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid…

    Hono Hono hono npm
  • Low 3.8
    CVE-2026-44459

    Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass…

    honojs hono langfuse-3-worker hono Wolfi npm