Hono security advisories

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

ReDoS in CORS middleware via Access-Control-Request-Headers

Algorithmic Complexity DoS in Language Middleware

Proxy Helper does not remove response headers listed in the `Connection` header

`memo()` retains SSR output across requests, leading to cross-user data disclosure

hono/jsx does not isolate context per request, leading to cross-request data disclosure

Server-Side XSS via JSX Escaping Bypass in cx() Utility

API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice

Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`

CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard

Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

JWT middleware accepts any Authorization scheme, not only Bearer

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

IP Restriction bypasses static deny rules for non-canonical IPv6

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

CSS Declaration Injection via Style Object Values in JSX SSR

Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection

bodyLimit() can be bypassed for chunked / unknown-length requests

Improper Handling of JSX Attribute Names Allows HTML Injection in hono/jsx SSR

Middleware bypass via repeated slashes in serveStatic

Path traversal in toSSG() allows writing files outside the output directory

Incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

Missing validation of cookie name on write path in setCookie()

Non-breaking space prefix bypass in cookie name handling in getCookie()

__proto__ key allowed in parseBody({ dot: true })

Arbitrary file access via serveStatic vulnerability

SSE Control Field Injection via CR/LF in writeSSE()

Cookie Attribute Injection via Unsanitized domain and path in setCookie()

Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo

Timing comparison hardening in basicAuth and bearerAuth

Cache Middleware ignores `Cache-Control: private` leading to Web Cache Deception

IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing

Arbitrary Key Read in Serve static Middleware(Cloudflare Workers Adapter)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in hono

JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass

JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)

Vary Header Injection leading to potential CORS Bypass

Improper Authorization in hono

Body Limit Middleware Bypass

Flaw in URL path parsing could cause path confusion

Bypass CSRF Middleware by a request without Content-Type header

Bypass CSRF middleware

Restricted Directory Traversal in serveStatic with deno

Named path parameters can be overridden in TrieRouter