610 matches found
GHSA-8J4G-W8FX-2239 Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
Summary The built-in CORS middleware hono/cors parses the attacker-controlled Access-Control-Request-Headers request header during a preflight OPTIONS request using a regular expression whose running time is quadratic in the input length. A single request carrying a long run of whitespace can...
CVE-2026-50559 vulnerabilities
Vulnerabilities for packages: keycloak-fips, hono, request-9047-keycloak-fips, floci-az, apicurio-registry...
GHSA-QCXP-GM7M-4J5V vulnerabilities
Vulnerabilities for packages: keycloak-fips, hono, request-9047-keycloak-fips, floci-az, apicurio-registry...
hono: Hono - Timing Attack in basicAuth and bearerAuth Middleware
A flaw was found in Hono. This vulnerability, a timing attack, exists in the basicAuth and bearerAuth middlewares due to a non-constant-time string comparison. A remote attacker could exploit the early termination of string equality checks to infer valid credentials by precisely measuring respons...
hono: Hono - Timing Attack in basicAuth and bearerAuth Middleware
A flaw was found in Hono. This vulnerability, a timing attack, exists in the basicAuth and bearerAuth middlewares due to a non-constant-time string comparison. A remote attacker could exploit the early termination of string equality checks to infer valid credentials by precisely measuring respons...
CVE-2026-56764
A flaw was found in Hono. This vulnerability, a timing attack, exists in the basicAuth and bearerAuth middlewares due to a non-constant-time string comparison. A remote attacker could exploit the early termination of string equality checks to infer valid credentials by precisely measuring respons...
CVE-2026-59895
A flaw was found in Hono, a web application framework. The cx function within hono/css improperly handles class names during server-side rendering. This allows an attacker to inject untrusted values into a JSX class attribute, leading to the injection of arbitrary markup. This could result in...
CVE-2026-59897
A flaw was found in Hono, a web application framework. The AWS API Gateway v1 adapter incorrectly de-duplicates repeated request header values using a substring comparison, rather than an exact match. This can lead to incomplete data being received by middleware or application logic that relies o...
CVE-2026-59896
A flaw was found in Hono, a Web application framework. The hono/jsx component did not properly isolate context values per request during server-side rendering. This allowed data from a different in-flight request to be used after an asynchronous operation in a component. This could lead to...
ROOT-APP-NPM-CVE-2026-47676 CVE-2026-47676 in @rootio/hono - Patched by Root
Root has patched CVE-2026-47676 in the @rootio/hono package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-39407 CVE-2026-39407 in hono - Patched by Root
Root has patched CVE-2026-39407 in the hono package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-54289 CVE-2026-54289 in @rootio/hono - Patched by Root
Root has patched CVE-2026-54289 in the @rootio/hono package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-47673 CVE-2026-47673 in @rootio/hono - Patched by Root
Root has patched CVE-2026-47673 in the @rootio/hono package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-44458 CVE-2026-44458 in @rootio/hono - Patched by Root
Root has patched CVE-2026-44458 in the @rootio/hono package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-56761 CVE-2026-56761 in @rootio/hono - Patched by Root
Root has patched CVE-2026-56761 in the @rootio/hono package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-54287 CVE-2026-54287 in @rootio/hono - Patched by Root
Root has patched CVE-2026-54287 in the @rootio/hono package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-54288 CVE-2026-54288 in @rootio/hono - Patched by Root
Root has patched CVE-2026-54288 in the @rootio/hono package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-39408 CVE-2026-39408 in hono - Patched by Root
Root has patched CVE-2026-39408 in the hono package for Root:npm. Multiple fixed versions available...