hono@1.6.4

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to HTML Injection via the jsx element tag. An attacker can inject unintended HTML elements or attributes, corrupt the HTML structure, or execute scripts by supplying malicious tag names as input to the rendering process.

Note: This is only exploitable if applications construct JSX tag names from untrusted input; applications using static or allowlisted tag names are not affected.

Upgrade hono to version 4.12.16 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the bodyLimit function. An attacker can bypass request size restrictions by sending chunked or unknown-length requests, allowing oversized payloads to reach application handlers and potentially receive successful responses before the size check is enforced.

Upgrade hono to version 4.12.16 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the jsxAttr() and JSX attribute rendering paths in src/jsx/jsx-runtime.ts, src/jsx/base.ts, and src/jsx/dom/render.ts. An attacker can inject executable markup by supplying a crafted attribute name such as one containing quotes, angle brackets, or spaces through JSX props or spread attributes. This lets untrusted input break out of the intended attribute context during server-rendered output or DOM updates, leading to script execution in the user’s browser and compromising the affected page.

Upgrade hono to version 4.12.14 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the ipRestriction function. An attacker can bypass access restrictions by sending requests from IPv4-mapped IPv6 addresses, which are not properly matched against IPv4 allow or deny rules.

Upgrade hono to version 4.12.12 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Improper Input Validation via the getCookie function. An attacker can override legitimate cookies and bypass prefix protections by setting cookies with non-breaking space prefixes, leading to potential session fixation or hijacking.

Upgrade hono to version 4.12.12 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to HTTP Response Splitting via the setCookie function. An attacker can cause runtime errors and potentially disrupt application behavior by supplying specially crafted input as the cookie name, leading to malformed Set-Cookie header values.

Upgrade hono to version 4.12.12 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Directory Traversal via the serveStatic function. An attacker can access sensitive static files intended to be protected by route-based middleware by crafting request paths with repeated slashes, thereby bypassing authorization checks.

Upgrade hono to version 4.12.12 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Prototype Pollution in parseBody(), when the dot option is enabled. An attacker can supply objects with __proto__ properties, which may later be merged by other functions in the application, polluting their prototypes.

Upgrade hono to version 4.12.7 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Improper Handling of URL Encoding (Hex Encoding) via inconsistent URL decoding between the serveStatic process and route-based middleware protections. An attacker can access protected static resources without authorization by requesting paths with encoded slashes - e.g. /admin%2Fsecret.html.

Note: This vulnerability specifically affects applications that rely solely on route-based middleware to protect static subpaths.

Upgrade hono to version 4.12.4 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to CRLF Injection via the setCookie() utility. An attacker can inject unauthorized cookie attributes by supplying specially crafted input containing semicolons, carriage returns, or newline characters in the domain or path fields.

Notes:

• Successful exploitation requires the application to pass user-controlled input directly into the domain or path options of setCookie()
• This issue is limited to attribute-level manipulation within a single Set-Cookie header.

Upgrade hono to version 4.12.4 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Timing Attack via the timingSafeEqual() function. An attacker can infer sensitive information by performing timing analysis attacks during authentication comparisons.

Upgrade hono to version 4.11.10 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via improper handling of HTTP cache control directives, including Cache-Control: private and Cache-Control: no-store. An attacker can access sensitive information by sending unauthenticated requests that receive cached responses intended for authenticated users.

Upgrade hono to version 4.11.7 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Incorrect Authorization via improper validation of user-supplied paths in the serve-static middleware. An attacker can access internal asset keys by crafting requests that bypass intended path restrictions. This is only exploitable if the application is running on Cloudflare Workers and uses the Serve static Middleware with user-controllable request paths.

Upgrade hono to version 4.11.7 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the ErrorBoundary component of the jsx library, when untrusted user-controlled strings are rendered as raw HTML. An attacker can execute scripts in the victim's browser.

Upgrade hono to version 4.11.7 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Incorrect Regular Expression in the form of the IPV4_REGEX pattern not properly matching IPv4 octet ranges, and passing values above 255 on to convertIPv4ToBinary. An attacker can gain unauthorized access or bypass IP-based restrictions by submitting malicious IP addresses, such as via the X-Forwarded-For header. Applications that rely on these values for access control decisions are vulnerable.

Upgrade hono to version 4.11.7 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm due to the JWT verification middleware using unsafe default fallback algorithm. An attacker can gain unauthorized access or escalate privileges by crafting JWTs with manipulated alg header values and force the middleware to use default HS256 algorithm for verification.

Note:

Users that configured their app without JWK/JWKS middleware or explicitly restrict allowed algorithms are not affected.

Upgrade hono to version 4.11.4 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the JWT verification middleware fallback on unverified JWT header when alg field is not present. An attacker can gain unauthorized access or escalate privileges by crafting JWTs with manipulated alg header values and force the middleware to use unsafe symmetric algorithms for verification.

Note:

Users that configured their app without JWK/JWKS middleware or explicitly restrict allowed algorithms are not affected.

Upgrade hono to version 4.11.4 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to HTTP Request Smuggling via the CORS middleware, which copies the Vary header from the request to the response when the origin is not set to "*". An attacker can influence cache behavior or cause inconsistent cross-origin resource sharing enforcement by supplying crafted Vary headers in requests.

Note: This is exploitable if shared caches or proxies rely on the Vary header for cache key calculation.

Upgrade hono to version 4.10.3 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Unverified Ownership via the JWT authentication process. An attacker can gain unauthorized access to protected resources by presenting a valid token intended for a different audience when multiple services share the same issuer or keys.

Upgrade hono to version 4.10.2 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to HTTP Request Smuggling via the bodyLimit middleware when conflicting HTTP headers are present. An attacker can cause excessive memory or CPU consumption by sending oversized request bodies that bypass the configured size limit.

Note: This is exploitable if the deployment environment or runtime does not reject requests with both Content-Length and Transfer-Encoding: chunked headers.

Upgrade hono to version 4.9.7 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) through the csrf function. An attacker can bypass CSRF protection by sending a request without a Content-Type header.

Upgrade hono to version 4.6.5 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Cross-Site Request Forgery (CSRF) via the isRequestedByFormElementRe function. An attacker can bypass CSRF protection by using a crafted Content-Type header with case manipulation.

Upgrade hono to version 4.5.8 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') due to the use of TrieRouter or when matching patterns not supported by the default RegExpRouter. An attacker can influence the behavior of the application by injecting unintended parameters when deleting REST API resources.

Note:

This is only exploitable if a privileged user interacts with the application in a way that allows for parameter override.

Upgrade hono to version 3.11.7 or higher.

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') such that when using serveStatic with deno, it is possible to traverse the directory where main.ts is located, leading to the retrieval of unexpected files.

Upgrade hono to version 4.2.7 or higher.