hono 4.12.33

Direct Vulnerabilities

Known vulnerabilities in the hono package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Inefficient Algorithmic Complexity hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `languageDetector` middleware. An attacker can cause excessive CPU consumption and block unrelated requests by sending crafted language tags with a large number of hyphen-separated subtags. How to fix Inefficient Algorithmic Complexity? Upgrade `hono` to version 4.12.34 or higher.	>=4.12.0 <4.12.34
M HTTP Request Smuggling hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to HTTP Request Smuggling in the `proxy` process. An attacker can access connection-scoped or internal metadata by sending requests to an application that proxies responses from an origin specifying custom headers in the `Connection` response header. This is only exploitable if the origin server includes additional, non-standard headers in the `Connection` response header beyond the standard hop-by-hop headers. How to fix HTTP Request Smuggling? Upgrade `hono` to version 4.12.34 or higher.	>=4.7.0 <4.12.34
M Exposure of Data Element to Wrong Session hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session in the `memo` function. An attacker can access sensitive information belonging to other users by sending requests that trigger the reuse of server-side rendered HTML when components wrapped in `memo` obtain user- or request-specific data from an ambient context instead of through props. This is only exploitable if the application renders with server-side rendering using `hono/jsx`, wraps a component reading ambient request state in `memo`, and both requests reach the same warm instance. How to fix Exposure of Data Element to Wrong Session? Upgrade `hono` to version 4.12.34 or higher.	>=3.8.0 <4.12.34
M Regular Expression Denial of Service (ReDoS) hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the `cors` middleware during the parsing of the `Access-Control-Request-Headers` header via a regular expression with quadratic runtime complexity. An attacker can cause excessive CPU consumption and degrade or deny service by sending specially crafted preflight requests containing long runs of whitespace in the header value. Note: This is only exploitable if the `allowHeaders` option is left unset or empty in the middleware configuration. How to fix Regular Expression Denial of Service (ReDoS)? Upgrade `hono` to version 4.12.34 or higher.	<4.12.34

Vulnerability

Vulnerable Version

Inefficient Algorithmic Complexity

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the languageDetector middleware. An attacker can cause excessive CPU consumption and block unrelated requests by sending crafted language tags with a large number of hyphen-separated subtags.

How to fix Inefficient Algorithmic Complexity?

Upgrade hono to version 4.12.34 or higher.

>=4.12.0 <4.12.34

HTTP Request Smuggling

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to HTTP Request Smuggling in the proxy process. An attacker can access connection-scoped or internal metadata by sending requests to an application that proxies responses from an origin specifying custom headers in the Connection response header. This is only exploitable if the origin server includes additional, non-standard headers in the Connection response header beyond the standard hop-by-hop headers.

How to fix HTTP Request Smuggling?

Upgrade hono to version 4.12.34 or higher.

>=4.7.0 <4.12.34

Exposure of Data Element to Wrong Session

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session in the memo function. An attacker can access sensitive information belonging to other users by sending requests that trigger the reuse of server-side rendered HTML when components wrapped in memo obtain user- or request-specific data from an ambient context instead of through props. This is only exploitable if the application renders with server-side rendering using hono/jsx, wraps a component reading ambient request state in memo, and both requests reach the same warm instance.

How to fix Exposure of Data Element to Wrong Session?

Upgrade hono to version 4.12.34 or higher.

>=3.8.0 <4.12.34

Regular Expression Denial of Service (ReDoS)

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the cors middleware during the parsing of the Access-Control-Request-Headers header via a regular expression with quadratic runtime complexity. An attacker can cause excessive CPU consumption and degrade or deny service by sending specially crafted preflight requests containing long runs of whitespace in the header value.

Note: This is only exploitable if the allowHeaders option is left unset or empty in the middleware configuration.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade hono to version 4.12.34 or higher.

<4.12.34

hono@4.12.33

Web framework built on Web Standards

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically