Hono vulnerabilities

Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths that the router matches in encoded form, reaching static files without authentication checks running.

Hono is a web framework for JavaScript. Prior to 4.11.4, the JWK/JWKS JWT verification middleware had a flaw that allowed the algorithm from the JWT header to influence signature verification when the selected JWK did not define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted.

Hono is a web framework for JavaScript. Prior to version 4.11.4, the JWT middleware for JWK/JWKS verification had a flaw where the JWT header's alg value could influence signature verification when the selected JWK did not explicitly specify an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted.

Path traversal vulnerability in serve-static on Windows via encoded backslash (%5C) in the request path. On Windows hosts, an encoded backslash (%5C) decodes to \, which the Windows path treats as a directory separator.

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream(). These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.

Hono framework versions 4.12.12 through 4.13.5 contain an incomplete fix for CVE-2026-39408 — toSSG() can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments. This affects build-time static site generation only, when ssgParams values are not fully developer-controlled.

In Hono (Web framework for JavaScript) prior to version 4.13.5, when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects created. Empty segments are preserved, so one deeply dotted field name can encode one nesting level per byte, while a large number of shallowly dotted fields can create the same amplification across a request. A request body within a normal size limit can therefore allocate an object graph far larger than the request after the body has already been accepted. An unauthenticated attacker who can reach an affected endpoint can send concurrent requests that exhaust the JavaScript heap, terminate the server process, and leave the service unavailable until restart. Dot-notation parsing is not enabled by default, and applications using the default behavior are not affected. This issue is fixed in version 4.13.5.

In Hono (Web framework for JavaScript) prior to version 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL(), reverse proxies, filtering rules, parameter allow and deny lists, access logging, request validation, and other middleware do not observe. The Cache Middleware removes the fragment when building its cache key, allowing a response influenced by parameters inside the fragment to be stored under a key that omits those parameters and later served to other users. This can bypass filtering and auditing, poison cached responses, and enable stored cross-site scripting when an affected parameter is reflected into cached HTML without escaping. Exploitation requires a runtime and intermediary path that passes a literal hash character through to the request URL; Cloudflare Workers and intermediaries that strip fragments are not affected. This issue is fixed in version 4.13.5.

Hono before version 4.12.34 has a ReDoS vulnerability in the built-in CORS middleware (hono/cors). During a preflight OPTIONS request, the middleware parses the Access-Control-Request-Headers header using a regular expression with quadratic complexity, which can cause long CPU consumption and block request processing. This affects the default configuration when allowHeaders is unset or empty.

A vulnerability in the Hono framework from version 3.8.0 to 4.12.33 affects memo() from hono/jsx, which retains the result of a server-side render and reuses it for later renders with equal props. Request-scoped values read inside the component are not part of the comparison, potentially causing a user to receive HTML rendered for another user's request. The issue is fixed in version 4.12.34.

Hono is a web application framework supporting any JavaScript runtime. From 4.7.0 to 4.12.33, the proxy() function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110, an intermediary must remove these headers before forwarding, but the function only removes standard hop-by-hop headers, potentially leading to disclosure of internal metadata.

A vulnerability in the Hono framework from version 4.12.0 to 4.12.33 affects the languageDetector middleware, which is vulnerable to algorithmic complexity denial of service when processing a crafted language tag with a large number of hyphen-separated subtags. The normalizeLanguage() function repeatedly calls parts.slice(0, i).join('-') for every possible prefix, causing quadratic processing growth. The issue is fixed in version 4.12.34.

Hono before version 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid credentials through precise timing measurements.

A vulnerability in Hono before version 4.12.7 allows the __proto__ key in parseBody with the dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.

In Hono framework versions 4.3.3 through 4.12.26, the AWS API Gateway v1 adapter incorrectly de-duplicates header values using substring comparison instead of exact match. This causes distinct repeated header values to be dropped, affecting the completeness of data processed by middleware or application logic.

In Hono framework versions 4.11.8 through 4.12.26, a vulnerability was found where context values are not isolated per request during server-side rendering (SSR). This allows data from another concurrent request to be used after an await statement in an async component.

Vulnerability in Hono framework (versions 4.0.0 to 4.12.26) in the cx() function from hono/css. The function composes class names from plain strings but marks the result as already escaped without HTML-escaping the input, allowing untrusted className values used in a JSX class attribute during server-side rendering to break out of the attribute and inject arbitrary markup.

A vulnerability in Hono before version 4.10.2 (fixed in 4.10.3) in the CORS middleware causes the Vary header from the incoming request to be copied into the response when the origin is not set to "*". An attacker can supply arbitrary Vary values that are reflected in the response, leading to cache key pollution and inconsistent CORS enforcement in environments relying on shared caches or proxies.

Hono before version 4.12.12 does not validate cookie names in the setCookie(), serialize(), and serializeSigned() functions, allowing invalid characters such as control characters. This can lead to malformed Set-Cookie header values.

Hono, a web framework supporting any JavaScript runtime, prior to version 4.12.12 has a vulnerability due to a discrepancy between browser cookie parsing and the parse() function, allowing cookie prefix protections to be bypassed and attacker-controlled cookies to override legitimate ones.

Hono prior to version 4.12.12 does not canonicalize IPv4-mapped IPv6 client addresses before applying IPv4 allow/deny rules in ipRestriction().

Hono prior to 4.12.12 contains a path traversal issue in toSSG() that allows files to be written outside the configured output directory during static site generation.

In Hono prior to version 4.12.12, a path handling inconsistency in serveStatic allows access to protected static files by using repeated slashes (//) in the request path. This can lead to a bypass of route-based authorization.