pwnmyvibecode_

Hono vulnerabilities and security advisories

The newest reviewed advisories for hono on npm. Each one shows which versions are affected, which version fixes it, and a prompt that has your AI agent check your project and upgrade only if it needs to.

Get an email when Hono has a new one

Email alerts are coming soon. This page updates every hour.

$ latest 30 · 7 critical, high or exploited

  • mediumSep 8, 2026

    Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

    • hono < 4.13.5 · fixed in 4.13.5
    GHSA-gqvv-2mrq-wpjvCVE-2026-84365
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-gqvv-2mrq-wpjv (CVE-2026-84365), severity medium
What it is: Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory
Affected packages:
- hono: affected versions < 4.13.5. Fixed in 4.13.5.
Details: https://github.com/advisories/GHSA-gqvv-2mrq-wpjv

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumSep 8, 2026

    Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

    • hono < 4.13.5 · fixed in 4.13.5
    GHSA-g6gw-c38x-mqfcCVE-2026-84364
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-g6gw-c38x-mqfc (CVE-2026-84364), severity medium
What it is: Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion
Affected packages:
- hono: affected versions < 4.13.5. Fixed in 4.13.5.
Details: https://github.com/advisories/GHSA-g6gw-c38x-mqfc

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumSep 8, 2026

    Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

    • hono < 4.13.5 · fixed in 4.13.5
    GHSA-crvj-82cr-hjcxCVE-2026-84363
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-crvj-82cr-hjcx (CVE-2026-84363), severity medium
What it is: Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
Affected packages:
- hono: affected versions < 4.13.5. Fixed in 4.13.5.
Details: https://github.com/advisories/GHSA-crvj-82cr-hjcx

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumAug 7, 2026

    Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

    • hono >= 3.8.0, < 4.12.34 · fixed in 4.12.34
    GHSA-f23p-vx2j-j53rCVE-2026-71850
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-f23p-vx2j-j53r (CVE-2026-71850), severity medium
What it is: Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure
Affected packages:
- hono: affected versions >= 3.8.0, < 4.12.34. Fixed in 4.12.34.
Details: https://github.com/advisories/GHSA-f23p-vx2j-j53r

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • lowAug 7, 2026

    Hono: Proxy Helper does not remove response headers listed in the `Connection` header

    • hono >= 4.7.0, < 4.12.34 · fixed in 4.12.34
    GHSA-79qm-7rj5-m7r9CVE-2026-71849
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-79qm-7rj5-m7r9 (CVE-2026-71849), severity low
What it is: Hono: Proxy Helper does not remove response headers listed in the `Connection` header
Affected packages:
- hono: affected versions >= 4.7.0, < 4.12.34. Fixed in 4.12.34.
Details: https://github.com/advisories/GHSA-79qm-7rj5-m7r9

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumAug 7, 2026

    Hono: Algorithmic Complexity DoS in Language Middleware

    • hono >= 4.12.0, < 4.12.34 · fixed in 4.12.34
    GHSA-54fx-42gc-7vw4CVE-2026-71848
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-54fx-42gc-7vw4 (CVE-2026-71848), severity medium
What it is: Hono: Algorithmic Complexity DoS in Language Middleware
Affected packages:
- hono: affected versions >= 4.12.0, < 4.12.34. Fixed in 4.12.34.
Details: https://github.com/advisories/GHSA-54fx-42gc-7vw4

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumAug 3, 2026

    Hono: ReDoS in CORS middleware via Access-Control-Request-Headers

    • hono < 4.12.34 · fixed in 4.12.34
    GHSA-8j4g-w8fx-2239CVE-2026-69207
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-8j4g-w8fx-2239 (CVE-2026-69207), severity medium
What it is: Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
Affected packages:
- hono: affected versions < 4.12.34. Fixed in 4.12.34.
Details: https://github.com/advisories/GHSA-8j4g-w8fx-2239

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJul 21, 2026

    hono/jsx does not isolate context per request, leading to cross-request data disclosure

    • hono >= 4.11.8, < 4.12.27 · fixed in 4.12.27
    GHSA-hvrm-45r6-mjfjCVE-2026-59896
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-hvrm-45r6-mjfj (CVE-2026-59896), severity medium
What it is: hono/jsx does not isolate context per request, leading to cross-request data disclosure
Affected packages:
- hono: affected versions >= 4.11.8, < 4.12.27. Fixed in 4.12.27.
Details: https://github.com/advisories/GHSA-hvrm-45r6-mjfj

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJul 21, 2026

    Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

    • hono >= 4.0.0, < 4.12.27 · fixed in 4.12.27
    GHSA-w62v-xxxg-mg59CVE-2026-59895
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-w62v-xxxg-mg59 (CVE-2026-59895), severity medium
What it is: Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility
Affected packages:
- hono: affected versions >= 4.0.0, < 4.12.27. Fixed in 4.12.27.
Details: https://github.com/advisories/GHSA-w62v-xxxg-mg59

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJul 21, 2026

    Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

    • hono >= 4.3.3, < 4.12.27 · fixed in 4.12.27
    GHSA-xgm2-5f3f-mvvcCVE-2026-59897
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-xgm2-5f3f-mvvc (CVE-2026-59897), severity medium
What it is: Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication
Affected packages:
- hono: affected versions >= 4.3.3, < 4.12.27. Fixed in 4.12.27.
Details: https://github.com/advisories/GHSA-xgm2-5f3f-mvvc

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJun 16, 2026

    hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`

    • hono < 4.12.25 · fixed in 4.12.25
    GHSA-rv63-4mwf-qqc2CVE-2026-54288
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-rv63-4mwf-qqc2 (CVE-2026-54288), severity medium
What it is: hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`
Affected packages:
- hono: affected versions < 4.12.25. Fixed in 4.12.25.
Details: https://github.com/advisories/GHSA-rv63-4mwf-qqc2

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJun 16, 2026

    hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

    • hono < 4.12.25 · fixed in 4.12.25
    GHSA-wgpf-jwqj-8h8pCVE-2026-54289
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-wgpf-jwqj-8h8p (CVE-2026-54289), severity medium
What it is: hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest
Affected packages:
- hono: affected versions < 4.12.25. Fixed in 4.12.25.
Details: https://github.com/advisories/GHSA-wgpf-jwqj-8h8p

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highJun 16, 2026

    hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard

    • hono < 4.12.25 · fixed in 4.12.25
    GHSA-88fw-hqm2-52qcCVE-2026-54290
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-88fw-hqm2-52qc (CVE-2026-54290), severity high
What it is: hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard
Affected packages:
- hono: affected versions < 4.12.25. Fixed in 4.12.25.
Details: https://github.com/advisories/GHSA-88fw-hqm2-52qc

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJun 16, 2026

    hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

    • hono < 4.12.25 · fixed in 4.12.25
    GHSA-wwfh-h76j-fc44CVE-2026-54286
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-wwfh-h76j-fc44 (CVE-2026-54286), severity medium
What it is: hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
Affected packages:
- hono: affected versions < 4.12.25. Fixed in 4.12.25.
Details: https://github.com/advisories/GHSA-wwfh-h76j-fc44

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJun 16, 2026

    hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice

    • hono < 4.12.25 · fixed in 4.12.25
    GHSA-j6c9-x7qj-28xfCVE-2026-54287
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-j6c9-x7qj-28xf (CVE-2026-54287), severity medium
What it is: hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice
Affected packages:
- hono: affected versions < 4.12.25. Fixed in 4.12.25.
Details: https://github.com/advisories/GHSA-j6c9-x7qj-28xf

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJun 4, 2026

    Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

    • hono < 4.12.21 · fixed in 4.12.21
    GHSA-2gcr-mfcq-wcc3CVE-2026-47676
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-2gcr-mfcq-wcc3 (CVE-2026-47676), severity medium
What it is: Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths
Affected packages:
- hono: affected versions < 4.12.21. Fixed in 4.12.21.
Details: https://github.com/advisories/GHSA-2gcr-mfcq-wcc3

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJun 4, 2026

    Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

    • hono < 4.12.21 · fixed in 4.12.21
    GHSA-xrhx-7g5j-rcj5CVE-2026-47674
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-xrhx-7g5j-rcj5 (CVE-2026-47674), severity medium
What it is: Hono: IP Restriction bypasses static deny rules for non-canonical IPv6
Affected packages:
- hono: affected versions < 4.12.21. Fixed in 4.12.21.
Details: https://github.com/advisories/GHSA-xrhx-7g5j-rcj5

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJun 4, 2026

    Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

    • hono < 4.12.21 · fixed in 4.12.21
    GHSA-3hrh-pfw6-9m5xCVE-2026-47675
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-3hrh-pfw6-9m5x (CVE-2026-47675), severity medium
What it is: Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection
Affected packages:
- hono: affected versions < 4.12.21. Fixed in 4.12.21.
Details: https://github.com/advisories/GHSA-3hrh-pfw6-9m5x

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJun 4, 2026

    Hono: JWT middleware accepts any Authorization scheme, not only Bearer

    • hono < 4.12.21 · fixed in 4.12.21
    GHSA-f577-qrjj-4474CVE-2026-47673
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-f577-qrjj-4474 (CVE-2026-47673), severity medium
What it is: Hono: JWT middleware accepts any Authorization scheme, not only Bearer
Affected packages:
- hono: affected versions < 4.12.21. Fixed in 4.12.21.
Details: https://github.com/advisories/GHSA-f577-qrjj-4474

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumMay 9, 2026

    Hono has CSS Declaration Injection via Style Object Values in JSX SSR

    • hono < 4.12.18 · fixed in 4.12.18
    GHSA-qp7p-654g-cw7pCVE-2026-44458
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-qp7p-654g-cw7p (CVE-2026-44458), severity medium
What it is: Hono has CSS Declaration Injection via Style Object Values in JSX SSR
Affected packages:
- hono: affected versions < 4.12.18. Fixed in 4.12.18.
Details: https://github.com/advisories/GHSA-qp7p-654g-cw7p

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • lowMay 9, 2026

    Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

    • hono < 4.12.18 · fixed in 4.12.18
    GHSA-hm8q-7f3q-5f36CVE-2026-44459
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-hm8q-7f3q-5f36 (CVE-2026-44459), severity low
What it is: Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()
Affected packages:
- hono: affected versions < 4.12.18. Fixed in 4.12.18.
Details: https://github.com/advisories/GHSA-hm8q-7f3q-5f36

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumMay 9, 2026

    Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

    • hono < 4.12.18 · fixed in 4.12.18
    GHSA-p77w-8qqv-26rmCVE-2026-44457
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-p77w-8qqv-26rm (CVE-2026-44457), severity medium
What it is: Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage
Affected packages:
- hono: affected versions < 4.12.18. Fixed in 4.12.18.
Details: https://github.com/advisories/GHSA-p77w-8qqv-26rm

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumMay 6, 2026

    Hono: bodyLimit() can be bypassed for chunked / unknown-length requests

    • hono < 4.12.16 · fixed in 4.12.16
    GHSA-9vqf-7f2p-gf9vCVE-2026-44456
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-9vqf-7f2p-gf9v (CVE-2026-44456), severity medium
What it is: Hono: bodyLimit() can be bypassed for chunked / unknown-length requests
Affected packages:
- hono: affected versions < 4.12.16. Fixed in 4.12.16.
Details: https://github.com/advisories/GHSA-9vqf-7f2p-gf9v

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumMay 6, 2026

    hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection

    • hono < 4.12.16 · fixed in 4.12.16
    GHSA-69xw-7hcm-h432CVE-2026-44455
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-69xw-7hcm-h432 (CVE-2026-44455), severity medium
What it is: hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection
Affected packages:
- hono: affected versions < 4.12.16. Fixed in 4.12.16.
Details: https://github.com/advisories/GHSA-69xw-7hcm-h432

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumApr 16, 2026

    hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR

    • hono < 4.12.14 · fixed in 4.12.14
    GHSA-458j-xx4x-4375CVE-2026-56761
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-458j-xx4x-4375 (CVE-2026-56761), severity medium
What it is: hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR
Affected packages:
- hono: affected versions < 4.12.14. Fixed in 4.12.14.
Details: https://github.com/advisories/GHSA-458j-xx4x-4375

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumApr 8, 2026

    Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()

    • hono < 4.12.12 · fixed in 4.12.12
    GHSA-r5rp-j6wh-rvv4CVE-2026-39410
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-r5rp-j6wh-rvv4 (CVE-2026-39410), severity medium
What it is: Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()
Affected packages:
- hono: affected versions < 4.12.12. Fixed in 4.12.12.
Details: https://github.com/advisories/GHSA-r5rp-j6wh-rvv4

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumApr 8, 2026

    Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

    • hono < 4.12.12 · fixed in 4.12.12
    GHSA-xpcf-pg52-r92gCVE-2026-39409
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-xpcf-pg52-r92g (CVE-2026-39409), severity medium
What it is: Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses
Affected packages:
- hono: affected versions < 4.12.12. Fixed in 4.12.12.
Details: https://github.com/advisories/GHSA-xpcf-pg52-r92g

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumApr 8, 2026

    Hono missing validation of cookie name on write path in setCookie()

    • hono < 4.12.12 · fixed in 4.12.12
    GHSA-26pp-8wgv-hjvmCVE-2026-56762
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-26pp-8wgv-hjvm (CVE-2026-56762), severity medium
What it is: Hono missing validation of cookie name on write path in setCookie()
Affected packages:
- hono: affected versions < 4.12.12. Fixed in 4.12.12.
Details: https://github.com/advisories/GHSA-26pp-8wgv-hjvm

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumApr 8, 2026

    Hono: Path traversal in toSSG() allows writing files outside the output directory

    • hono >= 4.0.0, <= 4.12.11 · fixed in 4.12.12
    GHSA-xf4j-xp2r-rqqxCVE-2026-39408
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-xf4j-xp2r-rqqx (CVE-2026-39408), severity medium
What it is: Hono: Path traversal in toSSG() allows writing files outside the output directory
Affected packages:
- hono: affected versions >= 4.0.0, <= 4.12.11. Fixed in 4.12.12.
Details: https://github.com/advisories/GHSA-xf4j-xp2r-rqqx

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumApr 8, 2026

    Hono: Middleware bypass via repeated slashes in serveStatic

    • hono < 4.12.12 · fixed in 4.12.12
    GHSA-wmmm-f939-6g9cCVE-2026-39407
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-wmmm-f939-6g9c (CVE-2026-39407), severity medium
What it is: Hono: Middleware bypass via repeated slashes in serveStatic
Affected packages:
- hono: affected versions < 4.12.12. Fixed in 4.12.12.
Details: https://github.com/advisories/GHSA-wmmm-f939-6g9c

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

From the GitHub Advisory Database, refreshed hourly. Full history on GitHub.

Keeping Hono patched

  • npm audit (or pnpm audit) lists known vulnerable packages in your lockfile, including ones pulled in by other packages.
  • Turn on Dependabot for your GitHub repo and it opens the upgrade for you when an advisory lands.
  • A patched framework doesn't cover your own setup: headers, cookies and HTTPS. The free check looks at those.