CVE-2026-84364

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects...

CVE-2026-84365

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG can still write files outside the configured output directory when a route parameter contains...

CVE-2026-84365 Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG can still write files outside the configured output directory when a route parameter contains...

CVE-2026-84365

Hono (a JavaScript web framework) has an incomplete fix for CVE-2026-39408 in its toSSG() static site generation method, affecting versions from 4.12.12 and fixed in 4.13.5 . The path normalization routine used to verify output paths does not fully collapse runs of consecutive parent-directory se...

CVE-2026-84365 Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG can still write files outside the configured output directory when a route parameter contains...

CVE-2026-84364

Hono is a JavaScript web application framework supporting any runtime. Prior to 4.13.5 , the parseBody() function, when dot-notation parsing is enabled, does not limit nesting depth or the number of intermediate objects created from dot-separated form field names. A single deeply dotted field nam...

CVE-2026-84364 Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects...

CVE-2026-84364 Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects...

CVE-2026-84363

Hono is a web application framework for any JavaScript runtime. Prior to 4.13.5 , its query helpers treat a question mark after a literal hash fragment as the start of a query string, allowing the application to read request parameters that browsers, reverse proxies, filtering rules, and other mi...

CVE-2026-84363 Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL, reverse proxies,...

CVE-2026-84363 Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL, reverse proxies,...

PT-2026-84501

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.13.5 Description Query helpers treat a question mark following a literal hash fragment as the start of a query string. This allows the application to read request parameters that are ignored by browsers, reverse proxie...

PT-2026-84502

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.13.5 Description When dot-notation parsing is enabled, the parseBody function fails to limit the nesting depth or the total number of intermediate objects created when expanding dot-separated form field names into nest...

PT-2026-84503

Name of the Vulnerable Software and Affected Versions Hono versions 4.12.12 through 4.13.4 Description The toSSG function fails to properly collapse consecutive parent-directory segments during static site generation. This occurs when the application uses ssgParams values that are not fully...

CVE-2026-81888

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...

GHSA-FM3F-CH8H-QW8Q @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

Summary The built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the state-based CSRF protection under default usage. Details The state...

@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

Summary The built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the state-based CSRF protection under default usage. Details The state...

@meow-meow-dev/server-utilities (>=1.0.1, <=3.5.2), @nile-squad/nile (>=1.2.0, <=1.4.11) +2 more potentially affected by CVE-2026-81888 via @hono/oauth-providers (>=0.6.2, <=0.8.5)

@hono/oauth-providers NPM version =0.6.2, =1.0.1, =1.2.0, =0.1.0, =0.1.1, =0.8.3 Source cves: CVE-2026-81888 Source advisory: OSV:GHSA-FM3F-CH8H-QW8Q...

CVE-2026-81888 @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...

EUVD-2026-68770

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...