| Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathsCVE-2026-111757 · GHSA-5R4P-P66F-JHC7 |
honoRed Hat Ansible Automation Platform 2/ansible-automation-platform-27/mcp-server-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })CVE-2026-56763 · GHSA-V8W9-8MX6-G223 |
hono |
npm |
متوسط
|
اصلاح گزارش شده |
|
| Hono vulnerable to Vary Header Injection leading to potential CORS BypassCVE-2025-71381 · GHSA-Q7JF-GF43-6X6P |
hono |
npm |
متوسط
|
اصلاح گزارش شده |
|
| hono/jsx renders plain strings unescaped in boundary components, leading to XSSCVE-2026-93981 · GHSA-HXH3-VQPV-XPQV |
honoMigration Toolkit for Applications 8/mta/mta-solution-server-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Hono missing validation of cookie name on write path in setCookie()CVE-2026-56762 · GHSA-26PP-8WGV-HJVM |
hono |
npm |
متوسط
|
اصلاح گزارش شده |
|
| Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosureCVE-2026-71850 · GHSA-F23P-VX2J-J53R |
hono |
npm |
متوسط
|
اصلاح گزارش شده |
|
| Hono: Proxy Helper does not remove response headers listed in the `Connection` headerCVE-2026-71849 · GHSA-79QM-7RJ5-M7R9 |
hono |
npm |
کم
|
اصلاح گزارش شده |
|
| Hono: ReDoS in CORS middleware via Access-Control-Request-HeadersCVE-2026-69207 · GHSA-8J4G-W8FX-2239 |
hono |
npm |
متوسط
|
اصلاح گزارش شده |
|
| Hono: Server-Side XSS via JSX Escaping Bypass in cx() UtilityCVE-2026-59895 · GHSA-W62V-XXXG-MG59 |
honoMigration Toolkit for Applications 8/mta/mta-solution-server-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 CVE-2026-47674 · GHSA-XRHX-7G5J-RCJ5 |
hono |
npm |
متوسط
|
اصلاح گزارش شده |
|
| Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded pathsCVE-2026-47676 · GHSA-2GCR-MFCQ-WCC3 |
hono |
npm |
متوسط
|
اصلاح گزارش شده |
|
| Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakageCVE-2026-44457 · GHSA-P77W-8QQV-26RM |
hono |
npm |
متوسط
|
اصلاح گزارش شده |
|
| Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()CVE-2026-44459 · GHSA-HM8Q-7F3Q-5F36 |
hono |
npm |
کم
|
اصلاح گزارش شده |
|
| Hono: Path traversal in toSSG() allows writing files outside the output directoryCVE-2026-39408 · GHSA-XF4J-XP2R-RQQX |
hono |
npm |
متوسط
|
اصلاح گزارش شده |
|
| Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()CVE-2026-39410 · GHSA-R5RP-J6WH-RVV4 |
hono |
npm |
متوسط
|
اصلاح گزارش شده |
|
| Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)CVE-2026-24473 · GHSA-W332-Q679-J88P |
hono |
npm |
متوسط
|
اصلاح گزارش شده |
|
| Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofingCVE-2026-24398 · GHSA-R354-F388-2FHH |
hono |
npm |
متوسط
|
اصلاح گزارش شده |
|
| Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)CVE-2026-22818 · GHSA-3VHC-576X-3QV4 |
hono |
npm |
زیاد
|
اصلاح گزارش شده |
|
| Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injectionCVE-2026-47675 · GHSA-3HRH-PFW6-9M5X |
hono |
npm |
متوسط
|
اصلاح گزارش شده |
|
| Hono CSRF middleware can be bypassed using crafted Content-Type headerCVE-2024-43787 · GHSA-RPFR-3M35-5VX5 |
hono |
npm |
کم
|
اصلاح گزارش شده |
|
