hono
npm52 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting honopage 2 of 2
- CVE-2026-84365MEDIUMCVSS 6.5EG 6.5fixed in 4.13.52026-09-01
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG() can still write files outside the con…
- CVE-2026-93981MEDIUMCVSS 4.7EG 4.7fixed in 4.13.72026-09-19
hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root …
Check whether hono is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for hono CVEs against the assets you own.
Book a Demo →