ROOT-APP-NPM-CVE-2026-54290 CVE-2026-54290 in @rootio/hono - Patched by Root

Root has patched CVE-2026-54290 in the @rootio/hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-39409 CVE-2026-39409 in hono - Patched by Root

Root has patched CVE-2026-39409 in the hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-39410 CVE-2026-39410 in hono - Patched by Root

Root has patched CVE-2026-39410 in the hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-47674 CVE-2026-47674 in @rootio/hono - Patched by Root

Root has patched CVE-2026-47674 in the @rootio/hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-26PP-8WGV-HJVM GHSA-26pp-8wgv-hjvm in hono - Patched by Root

Root has patched GHSA-26pp-8wgv-hjvm in the hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-54286 CVE-2026-54286 in @rootio/hono - Patched by Root

Root has patched CVE-2026-54286 in the @rootio/hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44455 CVE-2026-44455 in @rootio/hono - Patched by Root

Root has patched CVE-2026-44455 in the @rootio/hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44457 CVE-2026-44457 in @rootio/hono - Patched by Root

Root has patched CVE-2026-44457 in the @rootio/hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44456 CVE-2026-44456 in @rootio/hono - Patched by Root

Root has patched CVE-2026-44456 in the @rootio/hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-47675 CVE-2026-47675 in @rootio/hono - Patched by Root

Root has patched CVE-2026-47675 in the @rootio/hono package for Root:npm. Multiple fixed versions available...

CVE-2026-54291 vulnerabilities

Vulnerabilities for packages: kayenta, apache-hop, kayenta-fips, camunda-zeebe, nacos, sonarqube, keycloak-fips, conductor, druid, apache-hop-fips, geoserver, request-9047-keycloak-fips, apicurio-registry, keycloak, dependency-track-apiserver, guacamole-client, traccar, floci, nuxeo, flyway-fips,...

GHSA-J92G-9F8W-J867 vulnerabilities

Vulnerabilities for packages: kayenta, apache-hop, kayenta-fips, camunda-zeebe, nacos, sonarqube, keycloak-fips, conductor, druid, apache-hop-fips, geoserver, request-9047-keycloak-fips, apicurio-registry, keycloak, dependency-track-apiserver, guacamole-client, traccar, floci, nuxeo, flyway-fips,...

Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

Summary A WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header leaks memory permanently. The request's IncomingMessage is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the...

GHSA-9MQV-5HH9-4CGG Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

Summary A WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header leaks memory permanently. The request's IncomingMessage is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the...

EUVD-2026-42326

hono/jsx does not isolate context per request, leading to cross-request data disclosure...

GHSA-HVRM-45R6-MJFJ hono/jsx does not isolate context per request, leading to cross-request data disclosure

Summary hono/jsx did not isolate context values per request during server-side rendering. While an async component was suspended on await, its provided context value stayed observable to other requests rendering concurrently, so useContext could return a value from a different in-flight request...

NPM: hono/jsx does not isolate context per request, leading to cross-request data disclosure

NPM: hono/jsx does not isolate context per request, leading to cross-request data disclosure vulnerability discovered by ? in WordPress Npm hono versions = 4.11.8, 4.12.27...

Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

Summary cx in hono/css composes class names from plain strings but marks the result as already-escaped without HTML-escaping the input. When the result is used as a JSX class attribute during server-side rendering, the value is written into the attribute unescaped, so untrusted input can break ou...

GHSA-W62V-XXXG-MG59 Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

Summary cx in hono/css composes class names from plain strings but marks the result as already-escaped without HTML-escaping the input. When the result is used as a JSX class attribute during server-side rendering, the value is written into the attribute unescaped, so untrusted input can break ou...

0pflow (>=0.1.0-dev.2580522, <=0.1.0-dev.f5622ac), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +668 more potentially affected by CVE-2026-59895 via hono (>=4.0.0, <=4.12.26)

hono NPM version =4.0.0, =0.1.0-dev.2580522, =0.1.8-fix.3, =0.0.2, =0.3.1, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.17.0, =0.2.0, =0.4.0, =0.2.0, =0.17.0, =0.28.7 and more Source cves: CVE-2026-59895 Source advisory: OSV:GHSA-W62V-XXXG-MG59...