npm - OSV

GHSA-hxh3-vqpv-xpqv

npm/hono

hono/jsx renders plain strings unescaped in boundary components, leading to XSS 30 Sep

Fix available
Severity - 4.7 (Medium)

GHSA-gqvv-2mrq-wpjv

npm/hono

Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory 08 Sep

Fix available
Severity - 6.5 (Medium)

GHSA-g6gw-c38x-mqfc

npm/hono

Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion 08 Sep

Fix available
Severity - 5.3 (Medium)

GHSA-crvj-82cr-hjcx

npm/hono

Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials 08 Sep

Fix available
Severity - 5.9 (Medium)

GHSA-fm3f-ch8h-qw8q

npm/@hono/oauth-providers

@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking 31 Aug

Fix available
Severity - 5.4 (Medium)

GHSA-f23p-vx2j-j53r

npm/hono

Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure 07 Aug

Fix available
Severity - 4.8 (Medium)

GHSA-79qm-7rj5-m7r9

npm/hono

Hono: Proxy Helper does not remove response headers listed in the `Connection` header 07 Aug

Fix available
Severity - 3.7 (Low)

GHSA-54fx-42gc-7vw4

npm/hono

Hono: Algorithmic Complexity DoS in Language Middleware 07 Aug

Fix available
Severity - 5.3 (Medium)

GHSA-8j4g-w8fx-2239

npm/hono

Hono: ReDoS in CORS middleware via Access-Control-Request-Headers 03 Aug

Fix available
Severity - 5.3 (Medium)

GHSA-9mqv-5hh9-4cgg

npm/@hono/node-server

Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake 21 Jul

Fix available
Severity - 5.3 (Medium)

GHSA-hvrm-45r6-mjfj

npm/hono

hono/jsx does not isolate context per request, leading to cross-request data disclosure 21 Jul

Fix available
Severity - 6.5 (Medium)

GHSA-w62v-xxxg-mg59

npm/hono

Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility 21 Jul

Fix available
Severity - 6.1 (Medium)

GHSA-xgm2-5f3f-mvvc

npm/hono

Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication 21 Jul

Fix available
Severity - 4.8 (Medium)

GHSA-frvp-7c67-39w9

npm/@hono/node-server

Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) 21 Jul

Fix available
Severity - 5.9 (Medium)

MAL-2026-5950

npm/@mastra/hono

Malicious code in @mastra/hono (npm) 17 Jun

No fix available

GHSA-rv63-4mwf-qqc2

npm/hono

hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length` 16 Jun

Fix available
Severity - 6.5 (Medium)

Vulnerabilities