Security feed

CGA-xv93-5489-xc94

CGA-ffcm-46x7-8r63

Summary When using parseBody({ dot: true }) in HonoRequest, specially crafted form field names such as __proto__.x could create objects containing a __proto__ property. If the parsed result is later merged into regula…

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v8w9-8mx6-g223. This link is maintained to preserve external references. Original Description Hono before 4.12.7 allows __proto__ k…

Summary A flaw in the CORS middleware allowed request Vary headers to be reflected into the response, enabling attacker-controlled Vary values and potentially affecting cache behavior. Details The middleware previousl…

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q7jf-gf43-6x6p. This link is maintained to preserve external references. Original Description Hono before 4.10.2 (fixed in 4.10.3)…

CGA-c592-h49m-m62w

CGA-2vg4-gq9g-4gcx

Summary hono/jsx does not HTML-escape a plain string placed directly as a child or fallback of Suspense or ErrorBoundary, as the only child of a Context.Provider, or as the root value of renderToString() / renderToRea…

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hxh3-vqpv-xpqv. This link is maintained to preserve external references. Original Description hono before 4.13.7 fails to HTML-esca…

CGA-4682-632p-x7r6

CGA-7qrg-mr89-9cgf

CGA-xfrr-9c5c-68c8

CGA-mpg6-2qr8-r38m

CGA-prpp-jrxq-6463

CGA-3j9w-fpc3-gw88

ECHO-3479-a34e-1fda

ECHO-f837-bbec-a395

ECHO-4b53-f5bc-1b65

ECHO-bd5b-948e-fdde