GHSA-M2CM-222F-QW44 vulnerabilities

Vulnerabilities for packages: hono, debezium...

CVE-2026-27727 vulnerabilities

Vulnerabilities for packages: hono, debezium...

GHSA-5476-XC4J-RQCV vulnerabilities

Vulnerabilities for packages: hono, debezium...

CVE-2026-27830 vulnerabilities

Vulnerabilities for packages: hono, debezium...

CVE-2026-27700

Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter hono/aws-lambda behind an Application Load Balancer ALB, the getConnInfo function incorrectly selected the first value from the X-Forwarded-For...

EUVD-2026-8644

Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo...

@bgord/bun (1.10.16), @ottocode/database (>=0.1.303, <=0.1.320) +5 more potentially affected by CVE-2026-27700 via hono (>=4.12.0, <=4.12.1)

hono NPM version =4.12.0, =0.1.303, =0.1.303, =0.1.303, =0.1.303, =2.2.0, =0.2.11, =0.2.51 Source cves: CVE-2026-27700 Source advisory: OSV:GHSA-XH87-MX6M-69F3...

@bgord/bun (1.10.16), @ottocode/database (>=0.1.303, <=0.1.320) +5 more potentially affected by CVE-2026-27700 via hono (>=4.12.0, <=4.12.1)

hono NPM version =4.12.0, =0.1.303, =0.1.303, =0.1.303, =0.1.303, =2.2.0, =0.2.11, =0.2.51 Source cves: CVE-2026-27700 Source advisory: SNYK:JS-HONO-15353409...

User Impersonation

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to User Impersonation via the getConnInfo function in the adapter/aws-lambda/conninfo.ts‎ file. An attacker can gain unauthorized access to resources protected by IP-based access controls by...

CVE-2026-27700

Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter hono/aws-lambda behind an Application Load Balancer ALB, the getConnInfo function incorrectly selected the first value from the X-Forwarded-For...

CVE-2026-27700 Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo

Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter hono/aws-lambda behind an Application Load Balancer ALB, the getConnInfo function incorrectly selected the first value from the X-Forwarded-For...

CVE-2026-27700 Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo

Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter hono/aws-lambda behind an Application Load Balancer ALB, the getConnInfo function incorrectly selected the first value from the X-Forwarded-For...

CVE-2026-27700

Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter hono/aws-lambda behind an Application Load Balancer ALB, the getConnInfo function incorrectly selected the first value from the X-Forwarded-For...

CVE-2026-27700 Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo

Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter hono/aws-lambda behind an Application Load Balancer ALB, the getConnInfo function incorrectly selected the first value from the X-Forwarded-For...

CVE-2026-27700

CVE-2026-27700 affects Hono’s AWS Lambda adapter behind ALB. In versions 4.12.0 and 4.12.1, getConnInfo() erroneously took the first value from the X-Forwarded-For header. Since AWS ALB appends the real client IP to the end of X-Forwarded-For, an attacker could control the first IP value, potenti...

Hono 数据伪造问题漏洞

Hono is a web framework built in TypeScript for the Hono community. Versions 4.12.0 and 4.12.1 of Hono contain a data manipulation vulnerability. This vulnerability arises from the use of the AWS Lambda adapter after an application load balancer. In this context, the getConnInfo function...

PT-2026-21921

Name of the Vulnerable Software and Affected Versions Hono versions 4.12.0 through 4.12.1 Description Hono is a Web application framework that provides support for any JavaScript runtime. When using the AWS Lambda adapter hono/aws-lambda behind an Application Load Balancer ALB, the getConnInfo...

Timing Attack

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Timing Attack via the timingSafeEqual function. An attacker can infer sensitive information by performing timing analysis attacks during authentication comparisons. Remediation Upgrade ho...

@a0dotrun/expose (>=0.0.2, <=0.0.4), @agentforce/adk (>=0.9.0, <=0.12.1) +367 more potentially affected by CVE-2026-56764 via hono (>=4.0.0, <=4.11.9)

hono NPM version =4.0.0, =0.0.2, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.8.0 and more Source cves: CVE-2026-56764 Source advisory: OSV:GHSA-GQ3J-XVXP-8HRF...

@a0dotrun/expose (>=0.0.2, <=0.0.4), @agentforce/adk (>=0.9.0, <=0.12.1) +367 more potentially affected by unknown CVE via hono (>=4.0.0, <=4.11.9)

hono NPM version =4.0.0, =0.0.2, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.8.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-HONO-15322749...