Skip to content
OpenAdvisories

Product · honojs

hono

53 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 3.4
    CVE-2026-126359

    Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection

    Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when < ends the …

    honojs hono hono npm
  • Low 3.7
    CVE-2026-71849

    Hono: Proxy Helper does not remove response headers listed in the `Connection` header

    Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy() function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, …

    honojs hono langfuse-3-worker langfuse-3-compat Wolfi npm
  • Low 3.8
    CVE-2026-44459

    Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass…

    honojs hono langfuse-3-worker hono Wolfi npm