roninforge-hono

roninforge-hono Cursor plugin for Hono v4 TypeScript edge web framework + TypeScript. Pinned to hono ^4.12.19, @hono/zod-validator ^0.8.0, @hono/zod-openapi ^1.4.0 peer zod ^4.x, @hono/node-server ^2.0.3 Node 20+. Teaches the v4 APIs that LLMs trained on pre-2024 data do not know c.json always...

CVE-2026-126358

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.1.4 until 4.13.16, RegExpRouter can omit wildcard middleware in three version-specific cases: since 4.13.0, middleware using the explicit default parameter pattern in /api/:tenant^/+/admin/ is not applied...

CVE-2026-126359

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when ends the template text or a preceding value and /...

CVE-2026-126357

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, mount and app.mount can remove a dynamic mount prefix using the route-pattern length rather than the matched-prefix length, allowing a crafted path to be forwarded as a protected inner route...

CVE-2026-126355

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, csrf limits origin validation to the content types normally sent by HTML forms and therefore does not validate text/ping requests generated by Chromium hyperlink auditing. Chrome and Edge can...

CVE-2026-126356

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.5.1 until 4.13.16, validator'form' uses a strict whole-header pattern that fails to recognize multipart/form-data when its Content-Type includes another legal parameter or extra whitespace after a...

CVE-2026-126355: honojs hono: Hono is a Web application framework that provides support for any JavaScript runtime

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, csrf limits origin validation to the content types normally sent by HTML forms and therefore does not validate text/ping requests generated by Chromium hyperlink auditing. Chrome and Edge can...

CVE-2026-126359: honojs hono: Hono is a Web application framework that provides support for any JavaScript runtime

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when element early and cause the remainder of the...

CVE-2026-126358: honojs hono: Hono is a Web application framework that provides support for any JavaScript runtime

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.1.4 until 4.13.16, RegExpRouter can omit wildcard middleware in three version-specific cases: since 4.13.0, middleware using the explicit default parameter pattern in /api/:tenant^/+/admin/ is not applied...

CVE-2026-126356: honojs hono: Hono is a Web application framework that provides support for any JavaScript runtime

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.5.1 until 4.13.16, validator'form' uses a strict whole-header pattern that fails to recognize multipart/form-data when its Content-Type includes another legal parameter or extra whitespace after a...

CVE-2026-126357: honojs hono: Hono is a Web application framework that provides support for any JavaScript runtime

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, mount and app.mount can remove a dynamic mount prefix using the route-pattern length rather than the matched-prefix length, allowing a crafted path to be forwarded as a protected inner route...

GHSA-46WX-V44X-9HH2 Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`)

Summary csrf validates a request only when its Content-Type is one of the three types an HTML form can send. Chromium's hyperlink auditing sends a cross-origin POST with the user's cookies and the content type text/ping, which is not in that list. The middleware does not look at Origin or...

Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`)

Summary csrf validates a request only when its Content-Type is one of the three types an HTML form can send. Chromium's hyperlink auditing sends a cross-origin POST with the user's cookies and the content type text/ping, which is not in that list. The middleware does not look at Origin or...

npm: Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`)

npm: Hono: csrf does not check requests sent by hyperlink auditing text/ping vulnerability discovered by ? in WordPress npm hono versions 4.13.16...

Hono: `validator('form')` skips validation for `multipart/form-data` requests with extra parameters

Summary validator'form' only recognizes a multipart/form-data Content-Type that carries nothing but a single boundary parameter. A request with another legal parameter, such as charset, or with extra whitespace after the ; is not recognized as a form. The validation callback then receives an empt...

npm: Hono: `validator('form')` skips validation for `multipart/form-data` requests with extra parameters

npm: Hono: validator'form' skips validation for multipart/form-data requests with extra parameters vulnerability discovered by ? in WordPress npm hono versions = 4.5.1, = 4.13.15...

GHSA-4H7H-RV7C-7M2V Hono: `validator('form')` skips validation for `multipart/form-data` requests with extra parameters

Summary validator'form' only recognizes a multipart/form-data Content-Type that carries nothing but a single boundary parameter. A request with another legal parameter, such as charset, or with extra whitespace after the ; is not recognized as a form. The validation callback then receives an empt...

npm: Hono: `mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix

npm: Hono: mount and app.mount can forward a path that bypasses middleware scoped inside the mount prefix vulnerability discovered by ? in WordPress npm hono versions 4.13.16...

Hono: `mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix

Summary mount and app.mount remove the mount prefix from the request path and forward the rest to the mounted application. Two mistakes in that step let a crafted request reach a route of the mounted application that the outer application protects with path-scoped middleware, such as an...

GHSA-4M76-XFJ5-7975 Hono: `mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix

Summary mount and app.mount remove the mount prefix from the request path and forward the rest to the mounted application. Two mistakes in that step let a crafted request reach a route of the mounted application that the outer application protects with path-scoped middleware, such as an...