H
Vendor security profile
honojs
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs11
Critical0
CISA KEV0
Public exploit0
Patch rate%82
Avg. CVSS5.2
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
6
4
1
CVE KEV
CVE severity distribution
11toplam CVE
Medium9 (82%)
Low2 (18%)
Patch and exploitation view
%82
Verified patch
%0
CISA KEV
%0
Public exploit
9Patch available
0Partial
0Workaround
0Vendor: no patch
2Unknown
Latest vulnerabilities
6.9
CVE-2026-109955
Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding
H
Patch status unknown
2.3
CVE-2026-93981
hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings
H
Patch verifiedEPSS %0
6.5
CVE-2026-84365
Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory
H
Patch verifiedEPSS %0
5.3
CVE-2026-84364
Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion
H
Patch verifiedEPSS %1
5.9
CVE-2026-84363
Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
H
Patch verifiedEPSS %0
5.4
CVE-2026-81888
@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking
H
Patch status unknownEPSS %0
5.3
CVE-2026-73565
@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake
H
Patch verifiedEPSS %1
5.3
CVE-2026-69207
Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
H
Patch verifiedEPSS %1
4.8
CVE-2026-71850
Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure
H
Patch verifiedEPSS %0
3.7
CVE-2026-71849
Hono: Proxy Helper does not remove response headers listed in the `Connection` header
H
Patch verifiedEPSS %0