[ Vendor · 3 CVEs ]
honojs
CVEs affecting honojs published in the last 30 days, plus any honojs CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-111757 | 19 Oct 2026 | CVSS 5.3 | Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathsHono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a… | Fix |
| CVE-2026-109955 | 13 Oct 2026 | CVSS 5.3 | honojs honoHono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix… | |
| CVE-2026-93981 | 19 Sep 2026 | CVSS 4.7 | hono/jsx renders plain strings unescaped in boundary components, leading to XSShono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary… | Fix |