CVE-2025-59139 Hono has Body Limit Middleware Bypass

Hono is a Web application framework that provides support for any JavaScript runtime. In versions prior to 4.9.7, a flaw in the bodyLimit middleware could allow bypassing the configured request body size limit when conflicting HTTP headers were present. The middleware previously prioritized the...

CVE-2025-59139

CVE-2025-59139 affects the Hono web framework (pre-4.9.7). A flaw in the bodyLimit middleware allowed bypassing the configured request body size limit when conflicting headers were present, because Content-Length could be prioritized over Transfer-Encoding: chunked. The HTTP spec requires Transfe...

CVE-2025-59139 Hono has Body Limit Middleware Bypass

Hono is a Web application framework that provides support for any JavaScript runtime. In versions prior to 4.9.7, a flaw in the bodyLimit middleware could allow bypassing the configured request body size limit when conflicting HTTP headers were present. The middleware previously prioritized the...

CVE-2025-59139

Hono is a Web application framework that provides support for any JavaScript runtime. In versions prior to 4.9.7, a flaw in the "bodyLimit" middleware could allow bypassing the configured request body size limit when conflicting HTTP headers were present. The middleware previously prioritized the...

CVE-2025-59139 Hono has Body Limit Middleware Bypass

Hono is a Web application framework that provides support for any JavaScript runtime. In versions prior to 4.9.7, a flaw in the bodyLimit middleware could allow bypassing the configured request body size limit when conflicting HTTP headers were present. The middleware previously prioritized the...

Hono 安全漏洞

Hono is a web framework written in TypeScript from the Hono community. A security vulnerability exists in Hono versions prior to 4.9.7, which stems from the bodyLimit middleware prioritizing the Content-Length header when handling conflicting HTTP headers, which could lead to a denial of service...

CVE-2025-59139: Uncontrolled Resource Consumption

Hono is a Web application framework that provides support for any JavaScript runtime. In versions prior to 4.9.7, a flaw in the bodyLimit middleware could allow bypassing the configured request body size limit when conflicting HTTP headers were present. The middleware previously prioritized the...

CVE-2025-58362

Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility function which could allow path confusion and potential bypass of proxy-level ACLs e.g. Nginx location blocks. The original implementation relie...

CVE-2025-58362

Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility function which could allow path confusion and potential bypass of proxy-level ACLs e.g. Nginx location blocks. The original implementation relie...

Hono 安全漏洞

Hono is a web framework written in TypeScript from the Hono community. A security vulnerability exists in Hono 4.9.5 and earlier versions, which stems from an error in the path resolution of the getPath function and could lead to bypassing proxy ACLs...

CVE-2025-58362: Use of Incorrectly-Resolved Name or Reference

Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility function which could allow path confusion and potential bypass of proxy-level ACLs e.g. Nginx location blocks. The original implementation relie...

CVE-2025-58362 Hono contains a flaw in URL path parsing, potentially leading to path confusion

Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility function which could allow path confusion and potential bypass of proxy-level ACLs e.g. Nginx location blocks. The original implementation relie...

CVE-2025-58362

Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility function which could allow path confusion and potential bypass of proxy-level ACLs e.g. Nginx location blocks. The original implementation relie...

CVE-2025-58362 Hono contains a flaw in URL path parsing, potentially leading to path confusion

Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility function which could allow path confusion and potential bypass of proxy-level ACLs e.g. Nginx location blocks. The original implementation relie...

CVE-2025-58362 Hono contains a flaw in URL path parsing, potentially leading to path confusion

Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility function which could allow path confusion and potential bypass of proxy-level ACLs e.g. Nginx location blocks. The original implementation relie...

@agentforce/adk (>=0.9.0, <=0.12.1), @agentkit-ai/bff-hono (1.0.0) +30 more potentially affected by CVE-2025-58362 via hono (>=4.8.0, <=4.9.5)

hono NPM version =4.8.0, =0.9.0, =0.11.2, =1.3.0-next.4, =1.3.2, =4.0.0-alpha.5, =0.67.0, =0.14.2, =0.4.0, =0.21.0, =0.21.0, =0.19.0, =0.16.0, =0.0.1, =0.0.6, =0.3.14 and more Source cves: CVE-2025-58362 Source advisory: OSV:GHSA-9HP6-4448-45G2...

@agentforce/adk (>=0.9.0, <=0.12.1), @agentkit-ai/bff-hono (1.0.0) +30 more potentially affected by CVE-2025-58362 via hono (>=4.8.0, <=4.9.5)

hono NPM version =4.8.0, =0.9.0, =0.11.2, =1.3.0-next.4, =1.3.2, =4.0.0-alpha.5, =0.67.0, =0.14.2, =0.4.0, =0.21.0, =0.21.0, =0.19.0, =0.16.0, =0.0.1, =0.0.6, =0.3.14 and more Source cves: CVE-2025-58362 Source advisory: SNYK:JS-HONO-12485162...

Use of Incorrectly-Resolved Name or Reference

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the getPath function in the utils/url.ts file. An attacker can gain unauthorized access to protected endpoints by sending specially craft...

Use of Incorrectly-Resolved Name or Reference

Overview org.webjars.npm:hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the getPath function in the utils/url.ts file. An attacker can gain unauthorized access to protected endpoints by sending...

x402-native-token-payment-demo (>=0.0.0-alpha, <=0.0.1) potentially affected by unknown CVE via x402-hono (0.3.4)

x402-hono NPM version 0.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on x402-hono and may be impacted: - x402-native-token-payment-demo =0.0.0-alpha, =0.0.1 Source cves: unknown CVE Source advisory: SNYK:JS-X402HONO-12239901...