Hono
15 CVEs tracked since 2026. Since Jan 2026, none of them reached CISA KEV.
Hono CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2026-01 | 6 | 0 |
| 2026-02 | null or fewer | |
| 2026-03 | null or fewer | |
| 2026-04 | null or fewer | |
| 2026-05 | 9 | 0 |
Products
The products that kept showing up in Hono's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting Hono.
- CVE-2026-56764Hono - Timing Attack in basicAuth and bearerAuth Middleware3.7
- CVE-2026-56763Hono - Prototype Pollution via __proto__ Key in parseBody with dot Option4.8
- CVE-2026-59895Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility6.1
- CVE-2026-59896hono/jsx does not isolate context per request, leading to cross-request data disclosure6.5
- CVE-2026-59897Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication4.8
- CVE-2025-71381Hono - Vary Header Injection in CORS Middleware6.5
- CVE-2026-56761hono - HTML Injection via Improper JSX Attribute Name Handling in SSR4.3
- CVE-2026-56762Hono - Missing Cookie Name Validation in setCookie()5.3
- CVE-2026-47673Hono: JWT middleware accepts any Authorization scheme, not only Bearer4.8
- CVE-2026-47674Hono: IP Restriction bypasses static deny rules for non-canonical IPv65.3
- CVE-2026-47675Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection4.3
- CVE-2026-47676Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths5.3
- CVE-2026-44459Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()3.8
- CVE-2026-44458Hono: CSS Declaration Injection via Style Object Values in JSX SSR4.3
- CVE-2026-44457Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage5.3
The record
- Peak rank
- #146 in May 2026
- Busiest month shown
- May 2026, 9 CVEs
- Months with a KEV entry
- 0 since Jan 2026
- Monthly snapshots
- 2 since 2026