Skip to content
OpenAdvisories

Vendor

honojs

55 known vulnerabilities.

Products

hono 48 node-server 6 @hono/oauth-providers 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-71849

    Hono: Proxy Helper does not remove response headers listed in the `Connection` header

    Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy() function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, …

    honojs hono langfuse-3-worker langfuse-3-compat Wolfi npm
  • Low 3.8
    CVE-2026-44459

    Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass…

    honojs hono langfuse-3-worker hono Wolfi npm