ROOT-APP-NPM-CVE-2026-47674 CVE-2026-47674 in @rootio/hono - Patched by Root

Root has patched CVE-2026-47674 in the @rootio/hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-54286 CVE-2026-54286 in @rootio/hono - Patched by Root

Root has patched CVE-2026-54286 in the @rootio/hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44457 CVE-2026-44457 in @rootio/hono - Patched by Root

Root has patched CVE-2026-44457 in the @rootio/hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44456 CVE-2026-44456 in @rootio/hono - Patched by Root

Root has patched CVE-2026-44456 in the @rootio/hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-47675 CVE-2026-47675 in @rootio/hono - Patched by Root

Root has patched CVE-2026-47675 in the @rootio/hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44455 CVE-2026-44455 in @rootio/hono - Patched by Root

Root has patched CVE-2026-44455 in the @rootio/hono package for Root:npm. Multiple fixed versions available...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js module @hono/node-server

Summary IBM App Connect Enterprise runtime is vulnerable to multiple vulnerabilities due to Node.js module @hono/node-server. Vulnerability Details CVEID:CVE-2026-54286 DESCRIPTION: Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows...

CVE-2026-54291 vulnerabilities

Vulnerabilities for packages: camunda-zeebe, dependency-track, traccar, keycloak-fips, apicurio-registry, geoserver, apache-hop-fips, kayenta, sonarqube, thingsboard, flyway, apicurio-registry-fips, keycloak, traccar-fips, nuxeo, floci, conductor-fips, guacamole-client, ghidra, nacos-docker,...

GHSA-J92G-9F8W-J867 vulnerabilities

Vulnerabilities for packages: camunda-zeebe, dependency-track, traccar, keycloak-fips, apicurio-registry, geoserver, apache-hop-fips, kayenta, sonarqube, thingsboard, flyway, apicurio-registry-fips, keycloak, traccar-fips, nuxeo, floci, conductor-fips, guacamole-client, ghidra, nacos-docker,...

@agent-vm/agent-vm (>=0.0.138, <=0.0.140), @agent-vm/agent-vm-worker (>=0.0.138, <=0.0.140) +119 more potentially affected by CVE-2026-73565 via @hono/node-server (>=2.0.0, <=2.0.9)

@hono/node-server NPM version =2.0.0, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.8.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.9 and more Source cves: CVE-2026-73565 Sourc...

Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

Summary A WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header leaks memory permanently. The request's IncomingMessage is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the...

@agent-vm/agent-vm (>=0.0.138, <=0.0.140), @agent-vm/agent-vm-worker (>=0.0.138, <=0.0.140) +119 more potentially affected by unknown CVE via @hono/node-server (>=2.0.0, <=2.0.9)

@hono/node-server NPM version =2.0.0, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.8.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.9 and more Source cves: unknown CVE Source...

GHSA-9MQV-5HH9-4CGG Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

Summary A WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header leaks memory permanently. The request's IncomingMessage is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the...

EUVD-2026-42326

hono/jsx does not isolate context per request, leading to cross-request data disclosure...

GHSA-HVRM-45R6-MJFJ hono/jsx does not isolate context per request, leading to cross-request data disclosure

Summary hono/jsx did not isolate context values per request during server-side rendering. While an async component was suspended on await, its provided context value stayed observable to other requests rendering concurrently, so useContext could return a value from a different in-flight request...

NPM: hono/jsx does not isolate context per request, leading to cross-request data disclosure

NPM: hono/jsx does not isolate context per request, leading to cross-request data disclosure vulnerability discovered by ? in WordPress Npm hono versions = 4.11.8, 4.12.27...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @activepieces/piece-ai (>=0.3.1, <=0.3.4) +401 more potentially affected by CVE-2026-59896 via hono (>=4.11.8, <=4.12.26)

hono NPM version =4.11.8, =0.1.8-fix.3, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.1.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-59896 Source advisory: OSV:GHSA-HVRM-45R6-MJFJ...

GHSA-W62V-XXXG-MG59 Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

Summary cx in hono/css composes class names from plain strings but marks the result as already-escaped without HTML-escaping the input. When the result is used as a JSX class attribute during server-side rendering, the value is written into the attribute unescaped, so untrusted input can break ou...

Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

Summary cx in hono/css composes class names from plain strings but marks the result as already-escaped without HTML-escaping the input. When the result is used as a JSX class attribute during server-side rendering, the value is written into the attribute unescaped, so untrusted input can break ou...

NPM: Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

NPM: Hono: Server-Side XSS via JSX Escaping Bypass in cx Utility vulnerability discovered by ? in WordPress Npm hono versions = 4.0.0, 4.12.27...