Hono 数据伪造问题漏洞

Hono is a web framework written in TypeScript from the Hono community. A data forgery issue vulnerability exists in Hono versions prior to 4.11.4 that stems from the JWT validation middleware allowing JWT header algorithmic values to influence signature validation, potentially leading to...

EUVD-2025-199279

Malicious code in @trpc-rate-limiter/hono npm...

MAL-2025-191328 Malicious code in @trpc-rate-limiter/hono (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e86780189d32c5c6215833b83e8ff4274af92653c41f51d8cb8f9c1e5262bccf The package @trpc-rate-limiter/hono was found to contain malicious code. Source: ghsa-malware...

Malicious code in @trpc-rate-limiter/hono (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e86780189d32c5c6215833b83e8ff4274af92653c41f51d8cb8f9c1e5262bccf The package @trpc-rate-limiter/hono was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-35885

Hono vulnerable to Vary Header Injection leading to potential CORS Bypass...

@a0dotrun/expose (>=0.0.2, <=0.0.4), @agentforce/adk (>=0.9.0, <=0.12.1) +223 more potentially affected by CVE-2025-71381 via hono (>=4.0.0, <=4.10.2)

hono NPM version =4.0.0, =0.0.2, =0.9.0, =0.1.9, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.7.1, =0.2.1, =0.6.1, =0.5.2, =0.0.3, =1.3.2, =0.1.0, =0.75.0, =0.81.2 and more Source cves: CVE-2025-71381 Source advisory: OSV:GHSA-Q7JF-GF43-6X6P...

@a0dotrun/expose (>=0.0.2, <=0.0.4), @agentforce/adk (>=0.9.0, <=0.12.1) +223 more potentially affected by unknown CVE via hono (>=4.0.0, <=4.10.2)

hono NPM version =4.0.0, =0.0.2, =0.9.0, =0.1.9, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.7.1, =0.2.1, =0.6.1, =0.5.2, =0.0.3, =1.3.2, =0.1.0, =0.75.0, =0.81.2 and more Source cves: unknown CVE Source advisory: SNYK:JS-HONO-13720736...

HTTP Request Smuggling

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to HTTP Request Smuggling via the CORS middleware, which copies the Vary header from the request to the response when the origin is not set to "". An attacker can influence cache behavior or...

Hono vulnerable to Vary Header Injection leading to potential CORS Bypass

Summary A flaw in the CORS middleware allowed request Vary headers to be reflected into the response, enabling attacker-controlled Vary values and potentially affecting cache behavior. Details The middleware previously copied the Vary header from the request when origin was not set to "". Since...

CVE-2025-62610

Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middleware does not provide a built-in aud Audience verification option, which can cause confused-deputy / token-mix-up issues: an API may accept a valid...

CVE-2025-62610

Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middleware does not provide a built-in aud Audience verification option, which can cause confused-deputy / token-mix-up issues: an API may accept a valid...

Unverified Ownership

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Unverified Ownership via the JWT authentication process. An attacker can gain unauthorized access to protected resources by presenting a valid token intended for a different audience when...

@a0dotrun/expose (>=0.0.2, <=0.0.4), @abyedev/hono-dotenv (1.0.0) +492 more potentially affected by CVE-2025-62610 via hono (>=1.6.4, <=4.10.1)

hono NPM version =1.6.4, =0.0.2, =5.0.0, =0.9.0, =0.1.9, =0.0.1, =0.0.2-a, =0.0.1, =0.1.22, =1.1.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.7.1, =0.2.1, =0.2.3 and more Source cves: CVE-2025-62610 Source advisory: SNYK:JS-HONO-13669873...

CVE-2025-62610 Hono Improperly Authorizes JWT Audience Validation

Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middleware does not provide a built-in aud Audience verification option, which can cause confused-deputy / token-mix-up issues: an API may accept a valid...

CVE-2025-62610

Hono's JWT Auth Middleware (versions 1.1.0 up to before 4.10.2) did not validate the aud (Audience) claim, potentially allowing tokens intended for other audiences to access a service. The issue is documented across multiple sources and is resolved by upgrading to version 4.10.2 or later. Affecte...

CVE-2025-62610 Hono Improperly Authorizes JWT Audience Validation

Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middleware does not provide a built-in aud Audience verification option, which can cause confused-deputy / token-mix-up issues: an API may accept a valid...

CVE-2025-62610 Hono Improperly Authorizes JWT Audience Validation

Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middleware does not provide a built-in aud Audience verification option, which can cause confused-deputy / token-mix-up issues: an API may accept a valid...

@a0dotrun/expose (>=0.0.2, <=0.0.4), @abyedev/hono-dotenv (1.0.0) +492 more potentially affected by CVE-2025-62610 via hono (>=1.6.4, <=4.10.1)

hono NPM version =1.6.4, =0.0.2, =5.0.0, =0.9.0, =0.1.9, =0.0.1, =0.0.2-a, =0.0.1, =0.1.22, =1.1.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.7.1, =0.2.1, =0.2.3 and more Source cves: CVE-2025-62610 Source advisory: OSV:GHSA-M732-5P4W-X69G...

Hono Improper Authorization vulnerability

Improper Authorization in Hono JWT Audience Validation Hono’s JWT authentication middleware did not validate the aud Audience claim by default. As a result, applications using the middleware without an explicit audience check could accept tokens intended for other audiences, leading to potential...

GHSA-M732-5P4W-X69G Hono Improper Authorization vulnerability

Improper Authorization in Hono JWT Audience Validation Hono’s JWT authentication middleware did not validate the aud Audience claim by default. As a result, applications using the middleware without an explicit audience check could accept tokens intended for other audiences, leading to potential...