Vulnerabilities
Last updated 48 minutes ago
| Package | Summary | Severity | Published | Modified |
|---|---|---|---|---|
hono
|
Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`) | Medium Risk 5.3 | 17 hours ago | 17 hours ago |
|
hono
|
Hono: `validator('form')` skips validation for `multipart/form-data` requests with extra parameters | Medium Risk 5.3 | 17 hours ago | 17 hours ago |
|
hono
|
Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection | Low Risk 3.4 | 17 hours ago | 17 hours ago |
|
hono
|
Hono: `mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix | Medium Risk 5.3 | 17 hours ago | 17 hours ago |
|
hono
|
Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator | Medium Risk 5.3 | 17 hours ago | 17 hours ago |
|
@hono/node-server
|
@hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy | Medium Risk 5.3 | 19 hours ago | 19 hours ago |
|
@hono/node-server
|
@hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process | Medium Risk 5.3 | 19 hours ago | 19 hours ago |
phonoviatts
|
Malicious code in phonoviatts (PyPI) | Unknown | 22 days ago | 15 days ago |
|
@hono/node-server
|
@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths | Medium Risk 5.3 | 15 days ago | 15 days ago |
|
@modelcontextprotocol/hono
|
MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length | High Risk 7.5 | 16 days ago | 16 days ago |
|
hono
|
Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths | Medium Risk 5.3 | 24 days ago | 24 days ago |
|
hono
|
Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true }) | Medium Risk 4.8 | 8 months ago | 1 month ago |
|
hono
|
Hono vulnerable to Vary Header Injection leading to potential CORS Bypass | Medium Risk 4.2 | 1 year ago | 1 month ago |
|
hono
|
hono/jsx renders plain strings unescaped in boundary components, leading to XSS | Medium Risk 4.7 | 1 month ago | 1 month ago |
|
hono
|
Hono missing validation of cookie name on write path in setCookie() | Medium Risk 5.3 | 7 months ago | 1 month ago |
|
@hono/oauth-providers
|
@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking | Medium Risk 5.4 | 2 months ago | 1 month ago |
|
hono
|
Hono: Proxy Helper does not remove response headers listed in the `Connection` header | Low Risk 3.7 | 3 months ago | 2 months ago |
|
hono
|
Hono: ReDoS in CORS middleware via Access-Control-Request-Headers | Medium Risk 5.3 | 3 months ago | 2 months ago |
|
hono
|
Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure | Medium Risk 4.8 | 3 months ago | 2 months ago |
|
hono
|
Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility | Medium Risk 6.1 | 3 months ago | 2 months ago |
|
hono
|
Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 | Medium Risk 5.3 | 5 months ago | 2 months ago |
|
hono
|
Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths | Medium Risk 5.3 | 5 months ago | 2 months ago |
|
hono
|
Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage | Medium Risk 5.3 | 6 months ago | 2 months ago |
|
hono
|
Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify() | Low Risk 3.8 | 6 months ago | 2 months ago |
|
@clerk/hono
|
Clerk has an authorization bypass when combining organization, billing, or reverification checks | High Risk 8.1 | 6 months ago | 2 months ago |
|
hono
|
Hono: Path traversal in toSSG() allows writing files outside the output directory | Medium Risk 6.0 | 7 months ago | 2 months ago |
|
hono
|
Hono: Non-breaking space prefix bypass in cookie name handling in getCookie() | Medium Risk 4.8 | 7 months ago | 2 months ago |
|
@hono/node-server
|
@hono/node-server: Middleware bypass via repeated slashes in serveStatic | Medium Risk 5.3 | 7 months ago | 2 months ago |
|
hono
|
Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing | Medium Risk 4.8 | 9 months ago | 2 months ago |
|
hono
|
Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter) | Medium Risk 5.3 | 9 months ago | 2 months ago |
|
hono
|
Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback) | High Risk 8.2 | 10 months ago | 2 months ago |
|
hono
|
Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection | Medium Risk 4.3 | 5 months ago | 2 months ago |
|
hono
|
Hono CSRF middleware can be bypassed using crafted Content-Type header | Medium Risk 5.0 | 2 years ago | 2 months ago |
|
hono
|
Hono: Algorithmic Complexity DoS in Language Middleware | Medium Risk 5.3 | 3 months ago | 2 months ago |
|
hono
|
Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication | Medium Risk 4.8 | 3 months ago | 2 months ago |
|
@hono/node-server
|
Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) | Medium Risk 5.9 | 3 months ago | 2 months ago |
|
hono
|
hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) | Medium Risk 5.9 | 5 months ago | 2 months ago |
|
hono
|
hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length` | Medium Risk 6.5 | 5 months ago | 2 months ago |
|
hono
|
hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest | Medium Risk 4.8 | 5 months ago | 2 months ago |
|
hono
|
Hono: JWT middleware accepts any Authorization scheme, not only Bearer | Medium Risk 4.8 | 5 months ago | 2 months ago |
|
hono
|
hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice | Medium Risk 5.3 | 5 months ago | 2 months ago |
|
hono
|
hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard | High Risk 7.1 | 5 months ago | 2 months ago |
|
hono
|
Hono has CSS Declaration Injection via Style Object Values in JSX SSR | Medium Risk 4.3 | 6 months ago | 2 months ago |
|
hono
|
Hono: bodyLimit() can be bypassed for chunked / unknown-length requests | Medium Risk 6.5 | 6 months ago | 2 months ago |
|
hono
|
hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection | Medium Risk 4.7 | 6 months ago | 2 months ago |
|
hono
|
Hono: Middleware bypass via repeated slashes in serveStatic | Medium Risk 5.3 | 7 months ago | 2 months ago |
|
hono
|
Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses | Medium Risk 5.3 | 7 months ago | 2 months ago |
|
hono
|
hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR | Medium Risk 4.3 | 7 months ago | 2 months ago |
|
@hono/node-server
|
@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware | High Risk 7.5 | 8 months ago | 2 months ago |
|
hono
|
Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE() | Medium Risk 6.5 | 8 months ago | 2 months ago |
Page 1