Homepage

org.webjars.npm:hono@4.13.1

  • latest version

    4.13.1

  • first published

    24 days ago

  • latest version published

    24 days ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.webjars.npm:hono package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Directory Traversal

    org.webjars.npm:hono is an Ultrafast web framework for the Edges

    Affected versions of this package are vulnerable to Directory Traversal in the toSSG() static site generation function, whose path normalization does not fully collapse runs of consecutive .. segments and treats output directories that differ only in how they are rooted as equivalent. An attacker can cause build output to be written outside the intended output directory by supplying a route parameter with enough .. sequences that reaches ssgParams from an untrusted source.

    Note: This affects build-time static site generation only, not request-time routing, and requires the application to build pages from ssgParams values sourced from untrusted origins such as a CMS, API, or user submissions.

    Note: This is a bypass of the fix for the vulnerability described in CVE-2026-39408.

    How to fix Directory Traversal?

    Upgrade org.webjars.npm:hono to version 4.13.5 or higher.

    [,4.13.5)
    • H
    HTTP Request Smuggling

    org.webjars.npm:hono is an Ultrafast web framework for the Edges

    Affected versions of this package are vulnerable to HTTP Request Smuggling in its query parsing helpers, which do not terminate at the URL fragment and parse a ? appearing after a # as the start of the query string. An attacker can smuggle parameters past upstream allow/deny lists and validation, poison cache entries with unobserved parameters, or achieve stored XSS in cached HTML, by placing query parameters after a # fragment so browsers, new URL(), and reverse proxies ignore them while the query helpers still read them. This requires a literal # in the request URL to reach the application, and deployments behind intermediaries that strip fragments or runtimes that normalize URLs, such as Cloudflare Workers, are unaffected.

    How to fix HTTP Request Smuggling?

    Upgrade org.webjars.npm:hono to version 4.13.5 or higher.

    [,4.13.5)
    • M
    Asymmetric Resource Consumption (Amplification)

    org.webjars.npm:hono is an Ultrafast web framework for the Edges

    Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) in the parseBody() function, which expands dot-separated form field names into nested objects without limiting nesting depth or total object creation. An attacker can exhaust the JavaScript heap and terminate the server process by sending concurrent requests with deeply dotted field names, since a body within the normal size limit allocates an object graph far larger than the request itself. This requires the endpoint to have dot-notation parsing enabled, which is off by default.

    How to fix Asymmetric Resource Consumption (Amplification)?

    Upgrade org.webjars.npm:hono to version 4.13.5 or higher.

    [,4.13.5)
    Go back to all versions of this package