Malicious code in @trpc-rate-limiter/hono (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e86780189d32c5c6215833b83e8ff4274af92653c41f51d8cb8f9c1e5262bccf The package @trpc-rate-limiter/hono was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-35885

Hono vulnerable to Vary Header Injection leading to potential CORS Bypass...

@a0dotrun/expose (>=0.0.2, <=0.0.4), @agentforce/adk (>=0.9.0, <=0.12.1) +223 more potentially affected by CVE-2025-71381 via hono (>=4.0.0, <=4.10.2)

hono NPM version =4.0.0, =0.0.2, =0.9.0, =0.1.9, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.7.1, =0.2.1, =0.6.1, =0.5.2, =0.0.3, =1.3.2, =0.1.0, =0.75.0, =0.81.2 and more Source cves: CVE-2025-71381 Source advisory: OSV:GHSA-Q7JF-GF43-6X6P...

HTTP Request Smuggling

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to HTTP Request Smuggling via the CORS middleware, which copies the Vary header from the request to the response when the origin is not set to "". An attacker can influence cache behavior or...

@a0dotrun/expose (>=0.0.2, <=0.0.4), @agentforce/adk (>=0.9.0, <=0.12.1) +223 more potentially affected by unknown CVE via hono (>=4.0.0, <=4.10.2)

hono NPM version =4.0.0, =0.0.2, =0.9.0, =0.1.9, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.7.1, =0.2.1, =0.6.1, =0.5.2, =0.0.3, =1.3.2, =0.1.0, =0.75.0, =0.81.2 and more Source cves: unknown CVE Source advisory: SNYK:JS-HONO-13720736...

Hono vulnerable to Vary Header Injection leading to potential CORS Bypass

Summary A flaw in the CORS middleware allowed request Vary headers to be reflected into the response, enabling attacker-controlled Vary values and potentially affecting cache behavior. Details The middleware previously copied the Vary header from the request when origin was not set to "". Since...

CVE-2025-62610

Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middleware does not provide a built-in aud Audience verification option, which can cause confused-deputy / token-mix-up issues: an API may accept a valid...

CVE-2025-62610

Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middleware does not provide a built-in aud Audience verification option, which can cause confused-deputy / token-mix-up issues: an API may accept a valid...

Unverified Ownership

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Unverified Ownership via the JWT authentication process. An attacker can gain unauthorized access to protected resources by presenting a valid token intended for a different audience when...

@a0dotrun/expose (>=0.0.2, <=0.0.4), @abyedev/hono-dotenv (1.0.0) +492 more potentially affected by CVE-2025-62610 via hono (>=1.6.4, <=4.10.1)

hono NPM version =1.6.4, =0.0.2, =5.0.0, =0.9.0, =0.1.9, =0.0.1, =0.0.2-a, =0.0.1, =0.1.22, =1.1.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.7.1, =0.2.1, =0.2.3 and more Source cves: CVE-2025-62610 Source advisory: SNYK:JS-HONO-13669873...

CVE-2025-62610

Hono's JWT Auth Middleware (versions 1.1.0 up to before 4.10.2) did not validate the aud (Audience) claim, potentially allowing tokens intended for other audiences to access a service. The issue is documented across multiple sources and is resolved by upgrading to version 4.10.2 or later. Affecte...

CVE-2025-62610 Hono Improperly Authorizes JWT Audience Validation

Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middleware does not provide a built-in aud Audience verification option, which can cause confused-deputy / token-mix-up issues: an API may accept a valid...

CVE-2025-62610 Hono Improperly Authorizes JWT Audience Validation

Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middleware does not provide a built-in aud Audience verification option, which can cause confused-deputy / token-mix-up issues: an API may accept a valid...

CVE-2025-62610 Hono Improperly Authorizes JWT Audience Validation

Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middleware does not provide a built-in aud Audience verification option, which can cause confused-deputy / token-mix-up issues: an API may accept a valid...

@a0dotrun/expose (>=0.0.2, <=0.0.4), @abyedev/hono-dotenv (1.0.0) +492 more potentially affected by CVE-2025-62610 via hono (>=1.6.4, <=4.10.1)

hono NPM version =1.6.4, =0.0.2, =5.0.0, =0.9.0, =0.1.9, =0.0.1, =0.0.2-a, =0.0.1, =0.1.22, =1.1.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.7.1, =0.2.1, =0.2.3 and more Source cves: CVE-2025-62610 Source advisory: OSV:GHSA-M732-5P4W-X69G...

Hono Improper Authorization vulnerability

Improper Authorization in Hono JWT Audience Validation Hono’s JWT authentication middleware did not validate the aud Audience claim by default. As a result, applications using the middleware without an explicit audience check could accept tokens intended for other audiences, leading to potential...

EUVD-2025-35580

Hono Improper Authorization vulnerability...

GHSA-M732-5P4W-X69G Hono Improper Authorization vulnerability

Improper Authorization in Hono JWT Audience Validation Hono’s JWT authentication middleware did not validate the aud Audience claim by default. As a result, applications using the middleware without an explicit audience check could accept tokens intended for other audiences, leading to potential...

Hono 授权问题漏洞

Hono is a web framework written in TypeScript from the Hono community. An authorization issue vulnerability exists in Hono versions 1.1.0 through prior to 4.10.2, which stems from the lack of built-in audience validation options in the JWT Auth Middleware, and could lead to token obfuscation and...

PT-2025-43405

Name of the Vulnerable Software and Affected Versions Hono versions 1.1.0 through 4.10.1 Description Hono’s JWT authentication middleware lacked built-in verification of the aud Audience claim. This could lead to confused-deputy or token-mix-up issues, where an API might accept a valid token...