{"schema_version":"2","view":"grouped","data":[{"id":75507,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-vmx4-c36x-fg4h","summary":"CGA-vmx4-c36x-fg4h","evidence":"osv:CGA-vmx4-c36x-fg4h","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vmx4-c36x-fg4h","aliases":["CGA-vmx4-c36x-fg4h"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vmx4-c36x-fg4h.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-29T01:43:57Z"}]}}],"modified":"2026-10-04T17:27:35.510858467Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8d5ca41d-a36f-46d5-b275-f8b878598d10","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vmx4-c36x-fg4h","advisory_id":"8d5ca41d-a36f-46d5-b275-f8b878598d10","event_types":["advisory"],"published_at":"2026-10-26T17:42:19.216235+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:35:20+00:00","detail_url":"/advisories/advisory%3A8d5ca41d-a36f-46d5-b275-f8b878598d10","group":{"id":"advisory:8d5ca41d-a36f-46d5-b275-f8b878598d10","revision":1,"primary_event_id":82175,"change":"published","superseded_by":[],"changed":{"id":82175,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-vmx4-c36x-fg4h","summary":"CGA-vmx4-c36x-fg4h","evidence":"osv:CGA-vmx4-c36x-fg4h","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vmx4-c36x-fg4h","aliases":["CGA-vmx4-c36x-fg4h"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vmx4-c36x-fg4h.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-29T01:43:57Z"}]}}],"modified":"2026-10-04T17:27:35.510858467Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8d5ca41d-a36f-46d5-b275-f8b878598d10","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vmx4-c36x-fg4h","advisory_id":"8d5ca41d-a36f-46d5-b275-f8b878598d10","event_types":["advisory"],"published_at":"2026-10-26T17:42:19.216235+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:35:20+00:00","detail_url":"/events/82175"},"members":[{"id":82175,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-vmx4-c36x-fg4h","summary":"CGA-vmx4-c36x-fg4h","evidence":"osv:CGA-vmx4-c36x-fg4h","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vmx4-c36x-fg4h","aliases":["CGA-vmx4-c36x-fg4h"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vmx4-c36x-fg4h.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-29T01:43:57Z"}]}}],"modified":"2026-10-04T17:27:35.510858467Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8d5ca41d-a36f-46d5-b275-f8b878598d10","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vmx4-c36x-fg4h","advisory_id":"8d5ca41d-a36f-46d5-b275-f8b878598d10","event_types":["advisory"],"published_at":"2026-10-26T17:42:19.216235+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:35:20+00:00","detail_url":"/events/82175"}]}},{"id":74268,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-7f77-93x4-fqmc","summary":"CGA-7f77-93x4-fqmc","evidence":"osv:CGA-7f77-93x4-fqmc","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-7f77-93x4-fqmc","aliases":["CGA-7f77-93x4-fqmc"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7f77-93x4-fqmc.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T07:21:11Z"}]}}],"modified":"2026-10-03T16:13:04.920136429Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:05420d15-9623-4943-9568-187736e66c8b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7f77-93x4-fqmc","advisory_id":"05420d15-9623-4943-9568-187736e66c8b","event_types":["advisory"],"published_at":"2026-10-26T09:16:27.550923+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T04:03:56+00:00","detail_url":"/advisories/advisory%3A05420d15-9623-4943-9568-187736e66c8b","group":{"id":"advisory:05420d15-9623-4943-9568-187736e66c8b","revision":1,"primary_event_id":78737,"change":"published","superseded_by":[],"changed":{"id":78737,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-7f77-93x4-fqmc","summary":"CGA-7f77-93x4-fqmc","evidence":"osv:CGA-7f77-93x4-fqmc","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-7f77-93x4-fqmc","aliases":["CGA-7f77-93x4-fqmc"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7f77-93x4-fqmc.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T07:21:11Z"}]}}],"modified":"2026-10-03T16:13:04.920136429Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:05420d15-9623-4943-9568-187736e66c8b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7f77-93x4-fqmc","advisory_id":"05420d15-9623-4943-9568-187736e66c8b","event_types":["advisory"],"published_at":"2026-10-26T09:16:27.550923+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T04:03:56+00:00","detail_url":"/events/78737"},"members":[{"id":78737,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-7f77-93x4-fqmc","summary":"CGA-7f77-93x4-fqmc","evidence":"osv:CGA-7f77-93x4-fqmc","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-7f77-93x4-fqmc","aliases":["CGA-7f77-93x4-fqmc"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7f77-93x4-fqmc.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T07:21:11Z"}]}}],"modified":"2026-10-03T16:13:04.920136429Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:05420d15-9623-4943-9568-187736e66c8b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7f77-93x4-fqmc","advisory_id":"05420d15-9623-4943-9568-187736e66c8b","event_types":["advisory"],"published_at":"2026-10-26T09:16:27.550923+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T04:03:56+00:00","detail_url":"/events/78737"}]}},{"id":74169,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-xv93-5489-xc94","summary":"CGA-xv93-5489-xc94","evidence":"osv:CGA-xv93-5489-xc94","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xv93-5489-xc94","aliases":["CGA-xv93-5489-xc94"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xv93-5489-xc94.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-22T01:22:24Z"}]}}],"modified":"2026-10-03T16:12:57.846325082Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:794eb6aa-dc34-4425-9a6c-1c72750883b2","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xv93-5489-xc94","advisory_id":"794eb6aa-dc34-4425-9a6c-1c72750883b2","event_types":["advisory"],"published_at":"2026-10-26T06:34:03.121718+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:51:40+00:00","detail_url":"/advisories/advisory%3A794eb6aa-dc34-4425-9a6c-1c72750883b2","group":{"id":"advisory:794eb6aa-dc34-4425-9a6c-1c72750883b2","revision":1,"primary_event_id":77313,"change":"published","superseded_by":[],"changed":{"id":77313,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-xv93-5489-xc94","summary":"CGA-xv93-5489-xc94","evidence":"osv:CGA-xv93-5489-xc94","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xv93-5489-xc94","aliases":["CGA-xv93-5489-xc94"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xv93-5489-xc94.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-22T01:22:24Z"}]}}],"modified":"2026-10-03T16:12:57.846325082Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:794eb6aa-dc34-4425-9a6c-1c72750883b2","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xv93-5489-xc94","advisory_id":"794eb6aa-dc34-4425-9a6c-1c72750883b2","event_types":["advisory"],"published_at":"2026-10-26T06:34:03.121718+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:51:40+00:00","detail_url":"/events/77313"},"members":[{"id":77313,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-xv93-5489-xc94","summary":"CGA-xv93-5489-xc94","evidence":"osv:CGA-xv93-5489-xc94","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xv93-5489-xc94","aliases":["CGA-xv93-5489-xc94"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xv93-5489-xc94.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-22T01:22:24Z"}]}}],"modified":"2026-10-03T16:12:57.846325082Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:794eb6aa-dc34-4425-9a6c-1c72750883b2","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xv93-5489-xc94","advisory_id":"794eb6aa-dc34-4425-9a6c-1c72750883b2","event_types":["advisory"],"published_at":"2026-10-26T06:34:03.121718+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:51:40+00:00","detail_url":"/events/77313"}]}},{"id":73635,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-ffcm-46x7-8r63","summary":"CGA-ffcm-46x7-8r63","evidence":"osv:CGA-ffcm-46x7-8r63","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-ffcm-46x7-8r63","aliases":["CGA-ffcm-46x7-8r63"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-ffcm-46x7-8r63.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T12:41:30Z"}]}}],"modified":"2026-10-03T16:12:43.080968234Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0bd07644-8ea4-4b57-a3ac-cd7df6bb8f40","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-ffcm-46x7-8r63","advisory_id":"0bd07644-8ea4-4b57-a3ac-cd7df6bb8f40","event_types":["advisory"],"published_at":"2026-10-26T04:38:46.755057+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:05:51+00:00","detail_url":"/advisories/advisory%3A0bd07644-8ea4-4b57-a3ac-cd7df6bb8f40","group":{"id":"advisory:0bd07644-8ea4-4b57-a3ac-cd7df6bb8f40","revision":1,"primary_event_id":76041,"change":"published","superseded_by":[],"changed":{"id":76041,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-ffcm-46x7-8r63","summary":"CGA-ffcm-46x7-8r63","evidence":"osv:CGA-ffcm-46x7-8r63","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-ffcm-46x7-8r63","aliases":["CGA-ffcm-46x7-8r63"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-ffcm-46x7-8r63.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T12:41:30Z"}]}}],"modified":"2026-10-03T16:12:43.080968234Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0bd07644-8ea4-4b57-a3ac-cd7df6bb8f40","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-ffcm-46x7-8r63","advisory_id":"0bd07644-8ea4-4b57-a3ac-cd7df6bb8f40","event_types":["advisory"],"published_at":"2026-10-26T04:38:46.755057+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:05:51+00:00","detail_url":"/events/76041"},"members":[{"id":76041,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"CGA-ffcm-46x7-8r63","summary":"CGA-ffcm-46x7-8r63","evidence":"osv:CGA-ffcm-46x7-8r63","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-ffcm-46x7-8r63","aliases":["CGA-ffcm-46x7-8r63"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-ffcm-46x7-8r63.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r40","component_type":"apk","component_version":"2.7.0-r40","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-21T12:41:30Z"}]}}],"modified":"2026-10-03T16:12:43.080968234Z","provider":"osv","upstream":["CVE-2025-71381","GHSA-cw3j-28qq-x3xh","GHSA-q7jf-gf43-6x6p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71381.json","https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"]},"related_cves":[{"value":"CVE-2025-71381","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0bd07644-8ea4-4b57-a3ac-cd7df6bb8f40","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2025-71381","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-ffcm-46x7-8r63","advisory_id":"0bd07644-8ea4-4b57-a3ac-cd7df6bb8f40","event_types":["advisory"],"published_at":"2026-10-26T04:38:46.755057+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:05:51+00:00","detail_url":"/events/76041"}]}},{"id":70991,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })","summary":"## Summary When using `parseBody({ dot: true })` in HonoRequest, specially crafted form field names such as `__proto__.x` could create objects containing a `__proto__` property. If the parsed result is later merged into regular JavaScript objects using unsafe merge patterns, this may lead to prototype pollution in the target object. ## Details The `parseBody({ dot: true })` feature supports dot notation to construct nested objects from form field names. In previous versions, the `__proto__` path segment was not filtered. As a result, specially crafted keys such as `__proto__.x` could produce objects containing `__proto__` properties. While this behavior does not directly modify `Object.prototype` within Hono itself, it may become exploitable if the parsed result is later merged into regular JavaScript objects using unsafe merge patterns. ## Impact Applications that merge parsed form data into regular objects using unsafe patterns (for example recursive deep merge utilities) may become vulnerable to prototype pollution.","evidence":"osv:GHSA-v8w9-8mx6-g223","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"GHSA-v8w9-8mx6-g223","aliases":["CVE-2026-56763","GHSA-v8w9-8mx6-g223"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.12.7"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-v8w9-8mx6-g223/GHSA-v8w9-8mx6-g223.json"}}],"modified":"2026-10-02T22:45:04.525587715Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://github.com/honojs/hono/commit/ef902257e0beacbb83d2a9549b3b83e03514a6fe","https://github.com/honojs/hono","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"],"provider_metadata":{"cwe_ids":["CWE-1321"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":null,"github_reviewed_at":"2026-03-11T00:31:47Z"}},"related_cves":[{"value":"CVE-2026-56763","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"osv:GHSA-v8w9-8mx6-g223","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","advisory_id":"22be7d5c-1a96-4280-a5f8-6152aa6a6b00","event_types":["advisory"],"published_at":"2026-10-25T22:46:13.148222+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-11T00:31:47+00:00","detail_url":"/advisories/osv%3AGHSA-v8w9-8mx6-g223","group":{"id":"osv:GHSA-v8w9-8mx6-g223","revision":1,"primary_event_id":71365,"change":"published","superseded_by":[],"changed":{"id":71365,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })","summary":"## Summary When using `parseBody({ dot: true })` in HonoRequest, specially crafted form field names such as `__proto__.x` could create objects containing a `__proto__` property. If the parsed result is later merged into regular JavaScript objects using unsafe merge patterns, this may lead to prototype pollution in the target object. ## Details The `parseBody({ dot: true })` feature supports dot notation to construct nested objects from form field names. In previous versions, the `__proto__` path segment was not filtered. As a result, specially crafted keys such as `__proto__.x` could produce objects containing `__proto__` properties. While this behavior does not directly modify `Object.prototype` within Hono itself, it may become exploitable if the parsed result is later merged into regular JavaScript objects using unsafe merge patterns. ## Impact Applications that merge parsed form data into regular objects using unsafe patterns (for example recursive deep merge utilities) may become vulnerable to prototype pollution.","evidence":"osv:GHSA-v8w9-8mx6-g223","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"GHSA-v8w9-8mx6-g223","aliases":["CVE-2026-56763","GHSA-v8w9-8mx6-g223"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.12.7"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-v8w9-8mx6-g223/GHSA-v8w9-8mx6-g223.json"}}],"modified":"2026-10-02T22:45:04.525587715Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://github.com/honojs/hono/commit/ef902257e0beacbb83d2a9549b3b83e03514a6fe","https://github.com/honojs/hono","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"],"provider_metadata":{"cwe_ids":["CWE-1321"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":null,"github_reviewed_at":"2026-03-11T00:31:47Z"}},"related_cves":[{"value":"CVE-2026-56763","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"osv:GHSA-v8w9-8mx6-g223","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","advisory_id":"22be7d5c-1a96-4280-a5f8-6152aa6a6b00","event_types":["advisory"],"published_at":"2026-10-25T22:46:13.148222+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-11T00:31:47+00:00","detail_url":"/events/71365"},"members":[{"id":71365,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })","summary":"## Summary When using `parseBody({ dot: true })` in HonoRequest, specially crafted form field names such as `__proto__.x` could create objects containing a `__proto__` property. If the parsed result is later merged into regular JavaScript objects using unsafe merge patterns, this may lead to prototype pollution in the target object. ## Details The `parseBody({ dot: true })` feature supports dot notation to construct nested objects from form field names. In previous versions, the `__proto__` path segment was not filtered. As a result, specially crafted keys such as `__proto__.x` could produce objects containing `__proto__` properties. While this behavior does not directly modify `Object.prototype` within Hono itself, it may become exploitable if the parsed result is later merged into regular JavaScript objects using unsafe merge patterns. ## Impact Applications that merge parsed form data into regular objects using unsafe patterns (for example recursive deep merge utilities) may become vulnerable to prototype pollution.","evidence":"osv:GHSA-v8w9-8mx6-g223","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"GHSA-v8w9-8mx6-g223","aliases":["CVE-2026-56763","GHSA-v8w9-8mx6-g223"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.12.7"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-v8w9-8mx6-g223/GHSA-v8w9-8mx6-g223.json"}}],"modified":"2026-10-02T22:45:04.525587715Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://github.com/honojs/hono/commit/ef902257e0beacbb83d2a9549b3b83e03514a6fe","https://github.com/honojs/hono","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"],"provider_metadata":{"cwe_ids":["CWE-1321"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":null,"github_reviewed_at":"2026-03-11T00:31:47Z"}},"related_cves":[{"value":"CVE-2026-56763","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"osv:GHSA-v8w9-8mx6-g223","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","advisory_id":"22be7d5c-1a96-4280-a5f8-6152aa6a6b00","event_types":["advisory"],"published_at":"2026-10-25T22:46:13.148222+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-11T00:31:47+00:00","detail_url":"/events/71365"}]}},{"id":70988,"cve_ids":[],"payload":{"kind":"withdrawal","title":"Duplicate Advisory: Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })","summary":"## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v8w9-8mx6-g223. This link is maintained to preserve external references. ## Original Description Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.","evidence":"osv:GHSA-3wcj-gjvf-fvch","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"GHSA-3wcj-gjvf-fvch","aliases":["GHSA-3wcj-gjvf-fvch"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-3wcj-gjvf-fvch/GHSA-3wcj-gjvf-fvch.json","last_known_affected_version_range":"< 4.12.7"}}],"modified":"2026-10-02T22:45:04.331285767Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"],"provider_metadata":{"cwe_ids":["CWE-1321"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":"2026-07-11T14:16:22Z","github_reviewed_at":"2026-10-02T22:35:59Z"}},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/1/score"},"group_id":"advisory:b90f03cb-ea73-4cc3-b10f-dbe884f11364","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-3wcj-gjvf-fvch","advisory_id":"b90f03cb-ea73-4cc3-b10f-dbe884f11364","event_types":["withdrawal"],"published_at":"2026-10-25T22:46:10.838688+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-11T15:30:23+00:00","detail_url":"/advisories/advisory%3Ab90f03cb-ea73-4cc3-b10f-dbe884f11364","group":{"id":"advisory:b90f03cb-ea73-4cc3-b10f-dbe884f11364","revision":1,"primary_event_id":71361,"change":"published","superseded_by":[],"changed":{"id":71361,"cve_ids":[],"payload":{"kind":"withdrawal","title":"Duplicate Advisory: Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })","summary":"## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v8w9-8mx6-g223. This link is maintained to preserve external references. ## Original Description Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.","evidence":"osv:GHSA-3wcj-gjvf-fvch","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"GHSA-3wcj-gjvf-fvch","aliases":["GHSA-3wcj-gjvf-fvch"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-3wcj-gjvf-fvch/GHSA-3wcj-gjvf-fvch.json","last_known_affected_version_range":"< 4.12.7"}}],"modified":"2026-10-02T22:45:04.331285767Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"],"provider_metadata":{"cwe_ids":["CWE-1321"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":"2026-07-11T14:16:22Z","github_reviewed_at":"2026-10-02T22:35:59Z"}},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/1/score"},"group_id":"advisory:b90f03cb-ea73-4cc3-b10f-dbe884f11364","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-3wcj-gjvf-fvch","advisory_id":"b90f03cb-ea73-4cc3-b10f-dbe884f11364","event_types":["withdrawal"],"published_at":"2026-10-25T22:46:10.838688+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-11T15:30:23+00:00","detail_url":"/events/71361"},"members":[{"id":71361,"cve_ids":[],"payload":{"kind":"withdrawal","title":"Duplicate Advisory: Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })","summary":"## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v8w9-8mx6-g223. This link is maintained to preserve external references. ## Original Description Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.","evidence":"osv:GHSA-3wcj-gjvf-fvch","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"GHSA-3wcj-gjvf-fvch","aliases":["GHSA-3wcj-gjvf-fvch"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-3wcj-gjvf-fvch/GHSA-3wcj-gjvf-fvch.json","last_known_affected_version_range":"< 4.12.7"}}],"modified":"2026-10-02T22:45:04.331285767Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"],"provider_metadata":{"cwe_ids":["CWE-1321"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":"2026-07-11T14:16:22Z","github_reviewed_at":"2026-10-02T22:35:59Z"}},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/1/score"},"group_id":"advisory:b90f03cb-ea73-4cc3-b10f-dbe884f11364","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-3wcj-gjvf-fvch","advisory_id":"b90f03cb-ea73-4cc3-b10f-dbe884f11364","event_types":["withdrawal"],"published_at":"2026-10-25T22:46:10.838688+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-11T15:30:23+00:00","detail_url":"/events/71361"}]}},{"id":70971,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"Hono vulnerable to Vary Header Injection leading to potential CORS Bypass","summary":"### Summary A flaw in the CORS middleware allowed request `Vary` headers to be reflected into the response, enabling attacker-controlled `Vary` values and potentially affecting cache behavior. ### Details The middleware previously copied the `Vary` header from the request when `origin` was not set to `\"*\"`. Since `Vary` is a response header that should only be managed by the server, this could allow an attacker to influence caching behavior or cause inconsistent CORS handling. Most environments will see impact only when shared caches or proxies rely on the `Vary` header. The practical effect varies by configuration. ### Impact May cause cache key pollution and inconsistent CORS enforcement in certain setups. No direct confidentiality, integrity, or availability impact in default configurations. ### Resolution Update to the latest patched release. The CORS middleware has been corrected to handle `Vary` exclusively as a response header.","evidence":"osv:GHSA-q7jf-gf43-6x6p","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"GHSA-q7jf-gf43-6x6p","aliases":["CVE-2025-71381","GHSA-q7jf-gf43-6x6p"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.10.3"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-q7jf-gf43-6x6p/GHSA-q7jf-gf43-6x6p.json"}}],"modified":"2026-10-02T18:45:04.883415459Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://github.com/honojs/hono/commit/d9b8b4b73b4f997994f2764013207365fe711282","https://github.com/honojs/hono","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"],"provider_metadata":{"cwe_ids":["CWE-444"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":null,"github_reviewed_at":"2025-10-24T19:15:13Z"}},"related_cves":[{"value":"CVE-2025-71381","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"osv:GHSA-q7jf-gf43-6x6p","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","advisory_id":"0e78e89c-6882-401f-8332-a31da26a2d7b","event_types":["advisory"],"published_at":"2026-10-25T22:45:57.600759+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2025-10-24T19:15:13+00:00","detail_url":"/advisories/osv%3AGHSA-q7jf-gf43-6x6p","group":{"id":"osv:GHSA-q7jf-gf43-6x6p","revision":1,"primary_event_id":71344,"change":"published","superseded_by":[],"changed":{"id":71344,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"Hono vulnerable to Vary Header Injection leading to potential CORS Bypass","summary":"### Summary A flaw in the CORS middleware allowed request `Vary` headers to be reflected into the response, enabling attacker-controlled `Vary` values and potentially affecting cache behavior. ### Details The middleware previously copied the `Vary` header from the request when `origin` was not set to `\"*\"`. Since `Vary` is a response header that should only be managed by the server, this could allow an attacker to influence caching behavior or cause inconsistent CORS handling. Most environments will see impact only when shared caches or proxies rely on the `Vary` header. The practical effect varies by configuration. ### Impact May cause cache key pollution and inconsistent CORS enforcement in certain setups. No direct confidentiality, integrity, or availability impact in default configurations. ### Resolution Update to the latest patched release. The CORS middleware has been corrected to handle `Vary` exclusively as a response header.","evidence":"osv:GHSA-q7jf-gf43-6x6p","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"GHSA-q7jf-gf43-6x6p","aliases":["CVE-2025-71381","GHSA-q7jf-gf43-6x6p"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.10.3"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-q7jf-gf43-6x6p/GHSA-q7jf-gf43-6x6p.json"}}],"modified":"2026-10-02T18:45:04.883415459Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://github.com/honojs/hono/commit/d9b8b4b73b4f997994f2764013207365fe711282","https://github.com/honojs/hono","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"],"provider_metadata":{"cwe_ids":["CWE-444"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":null,"github_reviewed_at":"2025-10-24T19:15:13Z"}},"related_cves":[{"value":"CVE-2025-71381","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"osv:GHSA-q7jf-gf43-6x6p","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","advisory_id":"0e78e89c-6882-401f-8332-a31da26a2d7b","event_types":["advisory"],"published_at":"2026-10-25T22:45:57.600759+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2025-10-24T19:15:13+00:00","detail_url":"/events/71344"},"members":[{"id":71344,"cve_ids":["CVE-2025-71381"],"payload":{"kind":"advisory","title":"Hono vulnerable to Vary Header Injection leading to potential CORS Bypass","summary":"### Summary A flaw in the CORS middleware allowed request `Vary` headers to be reflected into the response, enabling attacker-controlled `Vary` values and potentially affecting cache behavior. ### Details The middleware previously copied the `Vary` header from the request when `origin` was not set to `\"*\"`. Since `Vary` is a response header that should only be managed by the server, this could allow an attacker to influence caching behavior or cause inconsistent CORS handling. Most environments will see impact only when shared caches or proxies rely on the `Vary` header. The practical effect varies by configuration. ### Impact May cause cache key pollution and inconsistent CORS enforcement in certain setups. No direct confidentiality, integrity, or availability impact in default configurations. ### Resolution Update to the latest patched release. The CORS middleware has been corrected to handle `Vary` exclusively as a response header.","evidence":"osv:GHSA-q7jf-gf43-6x6p","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.10.3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"GHSA-q7jf-gf43-6x6p","aliases":["CVE-2025-71381","GHSA-q7jf-gf43-6x6p"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.10.3"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-q7jf-gf43-6x6p/GHSA-q7jf-gf43-6x6p.json"}}],"modified":"2026-10-02T18:45:04.883415459Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://github.com/honojs/hono/commit/d9b8b4b73b4f997994f2764013207365fe711282","https://github.com/honojs/hono","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"],"provider_metadata":{"cwe_ids":["CWE-444"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":null,"github_reviewed_at":"2025-10-24T19:15:13Z"}},"related_cves":[{"value":"CVE-2025-71381","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"osv:GHSA-q7jf-gf43-6x6p","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p","advisory_id":"0e78e89c-6882-401f-8332-a31da26a2d7b","event_types":["advisory"],"published_at":"2026-10-25T22:45:57.600759+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2025-10-24T19:15:13+00:00","detail_url":"/events/71344"}]}},{"id":70969,"cve_ids":[],"payload":{"kind":"withdrawal","title":"Duplicate Advisory: Hono vulnerable to Vary Header Injection leading to potential CORS Bypass","summary":"## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q7jf-gf43-6x6p. This link is maintained to preserve external references. ## Original Description Hono before 4.10.2 (fixed in 4.10.3) contains a flaw in its CORS middleware: when the origin is not set to \"*\", the middleware copies the Vary header from the incoming request into the response. Because Vary is a response header that should be managed by the server, an attacker can supply arbitrary Vary values that are reflected into the response, potentially causing cache key pollution and inconsistent CORS enforcement in environments that rely on shared caches or proxies.","evidence":"osv:GHSA-cw3j-28qq-x3xh","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"GHSA-cw3j-28qq-x3xh","aliases":["GHSA-cw3j-28qq-x3xh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-cw3j-28qq-x3xh/GHSA-cw3j-28qq-x3xh.json","last_known_affected_version_range":"< 4.10.3"}}],"modified":"2026-10-02T18:45:04.878855206Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"],"provider_metadata":{"cwe_ids":["CWE-113"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":"2026-06-30T23:16:52Z","github_reviewed_at":"2026-10-02T18:28:39Z"}},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/1/score"},"group_id":"advisory:ba2df83e-e856-4b3f-8a29-b4ede9e892c6","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-cw3j-28qq-x3xh","advisory_id":"ba2df83e-e856-4b3f-8a29-b4ede9e892c6","event_types":["withdrawal"],"published_at":"2026-10-25T22:45:55.031508+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-01T00:34:02+00:00","detail_url":"/advisories/advisory%3Aba2df83e-e856-4b3f-8a29-b4ede9e892c6","group":{"id":"advisory:ba2df83e-e856-4b3f-8a29-b4ede9e892c6","revision":1,"primary_event_id":71342,"change":"published","superseded_by":[],"changed":{"id":71342,"cve_ids":[],"payload":{"kind":"withdrawal","title":"Duplicate Advisory: Hono vulnerable to Vary Header Injection leading to potential CORS Bypass","summary":"## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q7jf-gf43-6x6p. This link is maintained to preserve external references. ## Original Description Hono before 4.10.2 (fixed in 4.10.3) contains a flaw in its CORS middleware: when the origin is not set to \"*\", the middleware copies the Vary header from the incoming request into the response. Because Vary is a response header that should be managed by the server, an attacker can supply arbitrary Vary values that are reflected into the response, potentially causing cache key pollution and inconsistent CORS enforcement in environments that rely on shared caches or proxies.","evidence":"osv:GHSA-cw3j-28qq-x3xh","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"GHSA-cw3j-28qq-x3xh","aliases":["GHSA-cw3j-28qq-x3xh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-cw3j-28qq-x3xh/GHSA-cw3j-28qq-x3xh.json","last_known_affected_version_range":"< 4.10.3"}}],"modified":"2026-10-02T18:45:04.878855206Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"],"provider_metadata":{"cwe_ids":["CWE-113"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":"2026-06-30T23:16:52Z","github_reviewed_at":"2026-10-02T18:28:39Z"}},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/1/score"},"group_id":"advisory:ba2df83e-e856-4b3f-8a29-b4ede9e892c6","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-cw3j-28qq-x3xh","advisory_id":"ba2df83e-e856-4b3f-8a29-b4ede9e892c6","event_types":["withdrawal"],"published_at":"2026-10-25T22:45:55.031508+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-01T00:34:02+00:00","detail_url":"/events/71342"},"members":[{"id":71342,"cve_ids":[],"payload":{"kind":"withdrawal","title":"Duplicate Advisory: Hono vulnerable to Vary Header Injection leading to potential CORS Bypass","summary":"## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q7jf-gf43-6x6p. This link is maintained to preserve external references. ## Original Description Hono before 4.10.2 (fixed in 4.10.3) contains a flaw in its CORS middleware: when the origin is not set to \"*\", the middleware copies the Vary header from the incoming request into the response. Because Vary is a response header that should be managed by the server, an attacker can supply arbitrary Vary values that are reflected into the response, potentially causing cache key pollution and inconsistent CORS enforcement in environments that rely on shared caches or proxies.","evidence":"osv:GHSA-cw3j-28qq-x3xh","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"GHSA-cw3j-28qq-x3xh","aliases":["GHSA-cw3j-28qq-x3xh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-cw3j-28qq-x3xh/GHSA-cw3j-28qq-x3xh.json","last_known_affected_version_range":"< 4.10.3"}}],"modified":"2026-10-02T18:45:04.878855206Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p","https://nvd.nist.gov/vuln/detail/CVE-2025-71381","https://www.vulncheck.com/advisories/hono-vary-header-injection-in-cors-middleware"],"provider_metadata":{"cwe_ids":["CWE-113"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":"2026-06-30T23:16:52Z","github_reviewed_at":"2026-10-02T18:28:39Z"}},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/1/score"},"group_id":"advisory:ba2df83e-e856-4b3f-8a29-b4ede9e892c6","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-cw3j-28qq-x3xh","advisory_id":"ba2df83e-e856-4b3f-8a29-b4ede9e892c6","event_types":["withdrawal"],"published_at":"2026-10-25T22:45:55.031508+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-01T00:34:02+00:00","detail_url":"/events/71342"}]}},{"id":64534,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-c592-h49m-m62w","summary":"CGA-c592-h49m-m62w","evidence":"osv:CGA-c592-h49m-m62w","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-c592-h49m-m62w","aliases":["CGA-c592-h49m-m62w"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c592-h49m-m62w.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r42","component_type":"apk","component_version":"2.7.0-r42","component_location":"/.PKGINFO","latest_event_status":"false_positive_determination","latest_event_timestamp":"2026-09-30T07:51:28Z"}]}}],"modified":"2026-10-01T18:28:03.193810582Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93981.json","https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://nvd.nist.gov/vuln/detail/CVE-2026-93981","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e100b5f0-720e-43a1-b2a9-574f07964d61","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c592-h49m-m62w","advisory_id":"e100b5f0-720e-43a1-b2a9-574f07964d61","event_types":["advisory"],"published_at":"2026-10-25T19:50:23.393417+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T01:43:56+00:00","detail_url":"/advisories/advisory%3Ae100b5f0-720e-43a1-b2a9-574f07964d61","group":{"id":"advisory:e100b5f0-720e-43a1-b2a9-574f07964d61","revision":1,"primary_event_id":63796,"change":"published","superseded_by":[],"changed":{"id":63796,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-c592-h49m-m62w","summary":"CGA-c592-h49m-m62w","evidence":"osv:CGA-c592-h49m-m62w","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-c592-h49m-m62w","aliases":["CGA-c592-h49m-m62w"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c592-h49m-m62w.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r42","component_type":"apk","component_version":"2.7.0-r42","component_location":"/.PKGINFO","latest_event_status":"false_positive_determination","latest_event_timestamp":"2026-09-30T07:51:28Z"}]}}],"modified":"2026-10-01T18:28:03.193810582Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93981.json","https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://nvd.nist.gov/vuln/detail/CVE-2026-93981","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e100b5f0-720e-43a1-b2a9-574f07964d61","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c592-h49m-m62w","advisory_id":"e100b5f0-720e-43a1-b2a9-574f07964d61","event_types":["advisory"],"published_at":"2026-10-25T19:50:23.393417+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T01:43:56+00:00","detail_url":"/events/63796"},"members":[{"id":63796,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-c592-h49m-m62w","summary":"CGA-c592-h49m-m62w","evidence":"osv:CGA-c592-h49m-m62w","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-c592-h49m-m62w","aliases":["CGA-c592-h49m-m62w"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c592-h49m-m62w.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r42","component_type":"apk","component_version":"2.7.0-r42","component_location":"/.PKGINFO","latest_event_status":"false_positive_determination","latest_event_timestamp":"2026-09-30T07:51:28Z"}]}}],"modified":"2026-10-01T18:28:03.193810582Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93981.json","https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://nvd.nist.gov/vuln/detail/CVE-2026-93981","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e100b5f0-720e-43a1-b2a9-574f07964d61","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c592-h49m-m62w","advisory_id":"e100b5f0-720e-43a1-b2a9-574f07964d61","event_types":["advisory"],"published_at":"2026-10-25T19:50:23.393417+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T01:43:56+00:00","detail_url":"/events/63796"}]}},{"id":64528,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2vg4-gq9g-4gcx","summary":"CGA-2vg4-gq9g-4gcx","evidence":"osv:CGA-2vg4-gq9g-4gcx","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2vg4-gq9g-4gcx","aliases":["CGA-2vg4-gq9g-4gcx"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2vg4-gq9g-4gcx.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r42","component_type":"apk","component_version":"2.7.0-r42","component_location":"/.PKGINFO","latest_event_status":"false_positive_determination","latest_event_timestamp":"2026-09-30T07:51:28Z"}]}}],"modified":"2026-10-01T18:27:54.836089805Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93981.json","https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://nvd.nist.gov/vuln/detail/CVE-2026-93981","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1adc94c7-0c4b-4a4b-a881-cbc1de21d2d6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2vg4-gq9g-4gcx","advisory_id":"1adc94c7-0c4b-4a4b-a881-cbc1de21d2d6","event_types":["advisory"],"published_at":"2026-10-25T19:50:21.196072+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T02:27:23+00:00","detail_url":"/advisories/advisory%3A1adc94c7-0c4b-4a4b-a881-cbc1de21d2d6","group":{"id":"advisory:1adc94c7-0c4b-4a4b-a881-cbc1de21d2d6","revision":1,"primary_event_id":63790,"change":"published","superseded_by":[],"changed":{"id":63790,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2vg4-gq9g-4gcx","summary":"CGA-2vg4-gq9g-4gcx","evidence":"osv:CGA-2vg4-gq9g-4gcx","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2vg4-gq9g-4gcx","aliases":["CGA-2vg4-gq9g-4gcx"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2vg4-gq9g-4gcx.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r42","component_type":"apk","component_version":"2.7.0-r42","component_location":"/.PKGINFO","latest_event_status":"false_positive_determination","latest_event_timestamp":"2026-09-30T07:51:28Z"}]}}],"modified":"2026-10-01T18:27:54.836089805Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93981.json","https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://nvd.nist.gov/vuln/detail/CVE-2026-93981","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1adc94c7-0c4b-4a4b-a881-cbc1de21d2d6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2vg4-gq9g-4gcx","advisory_id":"1adc94c7-0c4b-4a4b-a881-cbc1de21d2d6","event_types":["advisory"],"published_at":"2026-10-25T19:50:21.196072+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T02:27:23+00:00","detail_url":"/events/63790"},"members":[{"id":63790,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2vg4-gq9g-4gcx","summary":"CGA-2vg4-gq9g-4gcx","evidence":"osv:CGA-2vg4-gq9g-4gcx","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2vg4-gq9g-4gcx","aliases":["CGA-2vg4-gq9g-4gcx"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2vg4-gq9g-4gcx.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r42","component_type":"apk","component_version":"2.7.0-r42","component_location":"/.PKGINFO","latest_event_status":"false_positive_determination","latest_event_timestamp":"2026-09-30T07:51:28Z"}]}}],"modified":"2026-10-01T18:27:54.836089805Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93981.json","https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://nvd.nist.gov/vuln/detail/CVE-2026-93981","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1adc94c7-0c4b-4a4b-a881-cbc1de21d2d6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2vg4-gq9g-4gcx","advisory_id":"1adc94c7-0c4b-4a4b-a881-cbc1de21d2d6","event_types":["advisory"],"published_at":"2026-10-25T19:50:21.196072+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T02:27:23+00:00","detail_url":"/events/63790"}]}},{"id":52388,"cve_ids":["CVE-2026-93981"],"payload":{"kind":"advisory","title":"hono/jsx renders plain strings unescaped in boundary components, leading to XSS","summary":"### Summary `hono/jsx` does not HTML-escape a plain string placed directly as a child or `fallback` of `Suspense` or `ErrorBoundary`, as the only child of a `Context.Provider`, or as the root value of `renderToString()` / `renderToReadableStream()` from `hono/jsx/dom/server`. Such a string is emitted as markup instead of text. ### Details These paths stringify their input and treat the result as already-escaped HTML, so a plain string passes through unchanged. Notable cases: - `Suspense`: a string child, or a string `fallback` while a child suspends. With streaming, the fallback reaches the browser in the initial chunk. - `ErrorBoundary`: a string child alongside an asynchronous sibling. The all-synchronous case was fixed in 4.11.7 (GHSA-9r54-q6cx-xmh5). - `Context.Provider`: a single string child. Multiple children are escaped. - `hono/jsx/dom/server`: a string, or an array containing strings, passed as the root. A lone `{children}` forwarded by a wrapper component is enough to reach these paths. Strings wrapped in an element, values from `raw()` or the `html` helper, and client-side rendering with `hono/jsx/dom` are not affected. ### Impact An attacker who controls a string rendered in an affected position can inject arbitrary HTML into the server-rendered page, leading to cross-site scripting under the application's origin. This issue affects applications that render untrusted strings directly in one of the positions above during server-side rendering.","evidence":"osv:GHSA-hxh3-vqpv-xpqv","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.13.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"GHSA-hxh3-vqpv-xpqv","aliases":["CVE-2026-93981","GHSA-hxh3-vqpv-xpqv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.13.7"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-hxh3-vqpv-xpqv/GHSA-hxh3-vqpv-xpqv.json"}}],"modified":"2026-10-01T00:00:05.750907953Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://nvd.nist.gov/vuln/detail/CVE-2026-93981","https://github.com/honojs/hono/commit/2b8ed402cdab6dfc5e829b480806dcd8db94161e","https://github.com/honojs/hono","https://github.com/honojs/hono/releases/tag/v4.13.7","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"],"provider_metadata":{"cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":null,"github_reviewed_at":"2026-09-30T23:46:16Z"}},"related_cves":[{"value":"CVE-2026-93981","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":null},"group_id":"osv:GHSA-hxh3-vqpv-xpqv","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-hxh3-vqpv-xpqv","advisory_id":"3a984fb5-f504-4b59-9616-2a1bdfe59e60","event_types":["advisory"],"published_at":"2026-10-25T14:31:53.112891+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T23:46:16+00:00","detail_url":"/advisories/osv%3AGHSA-hxh3-vqpv-xpqv","group":{"id":"osv:GHSA-hxh3-vqpv-xpqv","revision":1,"primary_event_id":51916,"change":"published","superseded_by":[],"changed":{"id":51916,"cve_ids":["CVE-2026-93981"],"payload":{"kind":"advisory","title":"hono/jsx renders plain strings unescaped in boundary components, leading to XSS","summary":"### Summary `hono/jsx` does not HTML-escape a plain string placed directly as a child or `fallback` of `Suspense` or `ErrorBoundary`, as the only child of a `Context.Provider`, or as the root value of `renderToString()` / `renderToReadableStream()` from `hono/jsx/dom/server`. Such a string is emitted as markup instead of text. ### Details These paths stringify their input and treat the result as already-escaped HTML, so a plain string passes through unchanged. Notable cases: - `Suspense`: a string child, or a string `fallback` while a child suspends. With streaming, the fallback reaches the browser in the initial chunk. - `ErrorBoundary`: a string child alongside an asynchronous sibling. The all-synchronous case was fixed in 4.11.7 (GHSA-9r54-q6cx-xmh5). - `Context.Provider`: a single string child. Multiple children are escaped. - `hono/jsx/dom/server`: a string, or an array containing strings, passed as the root. A lone `{children}` forwarded by a wrapper component is enough to reach these paths. Strings wrapped in an element, values from `raw()` or the `html` helper, and client-side rendering with `hono/jsx/dom` are not affected. ### Impact An attacker who controls a string rendered in an affected position can inject arbitrary HTML into the server-rendered page, leading to cross-site scripting under the application's origin. This issue affects applications that render untrusted strings directly in one of the positions above during server-side rendering.","evidence":"osv:GHSA-hxh3-vqpv-xpqv","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.13.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"GHSA-hxh3-vqpv-xpqv","aliases":["CVE-2026-93981","GHSA-hxh3-vqpv-xpqv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.13.7"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-hxh3-vqpv-xpqv/GHSA-hxh3-vqpv-xpqv.json"}}],"modified":"2026-10-01T00:00:05.750907953Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://nvd.nist.gov/vuln/detail/CVE-2026-93981","https://github.com/honojs/hono/commit/2b8ed402cdab6dfc5e829b480806dcd8db94161e","https://github.com/honojs/hono","https://github.com/honojs/hono/releases/tag/v4.13.7","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"],"provider_metadata":{"cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":null,"github_reviewed_at":"2026-09-30T23:46:16Z"}},"related_cves":[{"value":"CVE-2026-93981","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":null},"group_id":"osv:GHSA-hxh3-vqpv-xpqv","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-hxh3-vqpv-xpqv","advisory_id":"3a984fb5-f504-4b59-9616-2a1bdfe59e60","event_types":["advisory"],"published_at":"2026-10-25T14:31:53.112891+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T23:46:16+00:00","detail_url":"/events/51916"},"members":[{"id":51916,"cve_ids":["CVE-2026-93981"],"payload":{"kind":"advisory","title":"hono/jsx renders plain strings unescaped in boundary components, leading to XSS","summary":"### Summary `hono/jsx` does not HTML-escape a plain string placed directly as a child or `fallback` of `Suspense` or `ErrorBoundary`, as the only child of a `Context.Provider`, or as the root value of `renderToString()` / `renderToReadableStream()` from `hono/jsx/dom/server`. Such a string is emitted as markup instead of text. ### Details These paths stringify their input and treat the result as already-escaped HTML, so a plain string passes through unchanged. Notable cases: - `Suspense`: a string child, or a string `fallback` while a child suspends. With streaming, the fallback reaches the browser in the initial chunk. - `ErrorBoundary`: a string child alongside an asynchronous sibling. The all-synchronous case was fixed in 4.11.7 (GHSA-9r54-q6cx-xmh5). - `Context.Provider`: a single string child. Multiple children are escaped. - `hono/jsx/dom/server`: a string, or an array containing strings, passed as the root. A lone `{children}` forwarded by a wrapper component is enough to reach these paths. Strings wrapped in an element, values from `raw()` or the `html` helper, and client-side rendering with `hono/jsx/dom` are not affected. ### Impact An attacker who controls a string rendered in an affected position can inject arbitrary HTML into the server-rendered page, leading to cross-site scripting under the application's origin. This issue affects applications that render untrusted strings directly in one of the positions above during server-side rendering.","evidence":"osv:GHSA-hxh3-vqpv-xpqv","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.13.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"GHSA-hxh3-vqpv-xpqv","aliases":["CVE-2026-93981","GHSA-hxh3-vqpv-xpqv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.13.7"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-hxh3-vqpv-xpqv/GHSA-hxh3-vqpv-xpqv.json"}}],"modified":"2026-10-01T00:00:05.750907953Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://nvd.nist.gov/vuln/detail/CVE-2026-93981","https://github.com/honojs/hono/commit/2b8ed402cdab6dfc5e829b480806dcd8db94161e","https://github.com/honojs/hono","https://github.com/honojs/hono/releases/tag/v4.13.7","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"],"provider_metadata":{"cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":null,"github_reviewed_at":"2026-09-30T23:46:16Z"}},"related_cves":[{"value":"CVE-2026-93981","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":null},"group_id":"osv:GHSA-hxh3-vqpv-xpqv","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-hxh3-vqpv-xpqv","advisory_id":"3a984fb5-f504-4b59-9616-2a1bdfe59e60","event_types":["advisory"],"published_at":"2026-10-25T14:31:53.112891+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T23:46:16+00:00","detail_url":"/events/51916"}]}},{"id":52385,"cve_ids":[],"payload":{"kind":"withdrawal","title":"Duplicate Advisory: hono/jsx renders plain strings unescaped in boundary components, leading to XSS","summary":"## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hxh3-vqpv-xpqv. This link is maintained to preserve external references. ## Original Description hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.","evidence":"osv:GHSA-6623-4q32-82v8","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"GHSA-6623-4q32-82v8","aliases":["GHSA-6623-4q32-82v8"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6623-4q32-82v8/GHSA-6623-4q32-82v8.json","last_known_affected_version_range":"< 4.13.7"}}],"modified":"2026-10-01T00:00:05.652739792Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://nvd.nist.gov/vuln/detail/CVE-2026-93981","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"],"provider_metadata":{"cwe_ids":["CWE-79"],"severity":"LOW","github_reviewed":true,"nvd_published_at":"2026-09-19T12:16:41Z","github_reviewed_at":"2026-09-30T23:46:00Z"}},"related_cves":[],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:3a4c5172-6df9-4615-8058-5e2f474fbac1","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6623-4q32-82v8","advisory_id":"3a4c5172-6df9-4615-8058-5e2f474fbac1","event_types":["withdrawal"],"published_at":"2026-10-25T14:31:51.131021+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-19T12:32:10+00:00","detail_url":"/advisories/advisory%3A3a4c5172-6df9-4615-8058-5e2f474fbac1","group":{"id":"advisory:3a4c5172-6df9-4615-8058-5e2f474fbac1","revision":1,"primary_event_id":51913,"change":"published","superseded_by":[],"changed":{"id":51913,"cve_ids":[],"payload":{"kind":"withdrawal","title":"Duplicate Advisory: hono/jsx renders plain strings unescaped in boundary components, leading to XSS","summary":"## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hxh3-vqpv-xpqv. This link is maintained to preserve external references. ## Original Description hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.","evidence":"osv:GHSA-6623-4q32-82v8","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"GHSA-6623-4q32-82v8","aliases":["GHSA-6623-4q32-82v8"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6623-4q32-82v8/GHSA-6623-4q32-82v8.json","last_known_affected_version_range":"< 4.13.7"}}],"modified":"2026-10-01T00:00:05.652739792Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://nvd.nist.gov/vuln/detail/CVE-2026-93981","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"],"provider_metadata":{"cwe_ids":["CWE-79"],"severity":"LOW","github_reviewed":true,"nvd_published_at":"2026-09-19T12:16:41Z","github_reviewed_at":"2026-09-30T23:46:00Z"}},"related_cves":[],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:3a4c5172-6df9-4615-8058-5e2f474fbac1","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6623-4q32-82v8","advisory_id":"3a4c5172-6df9-4615-8058-5e2f474fbac1","event_types":["withdrawal"],"published_at":"2026-10-25T14:31:51.131021+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-19T12:32:10+00:00","detail_url":"/events/51913"},"members":[{"id":51913,"cve_ids":[],"payload":{"kind":"withdrawal","title":"Duplicate Advisory: hono/jsx renders plain strings unescaped in boundary components, leading to XSS","summary":"## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hxh3-vqpv-xpqv. This link is maintained to preserve external references. ## Original Description hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.","evidence":"osv:GHSA-6623-4q32-82v8","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"GHSA-6623-4q32-82v8","aliases":["GHSA-6623-4q32-82v8"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6623-4q32-82v8/GHSA-6623-4q32-82v8.json","last_known_affected_version_range":"< 4.13.7"}}],"modified":"2026-10-01T00:00:05.652739792Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://nvd.nist.gov/vuln/detail/CVE-2026-93981","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"],"provider_metadata":{"cwe_ids":["CWE-79"],"severity":"LOW","github_reviewed":true,"nvd_published_at":"2026-09-19T12:16:41Z","github_reviewed_at":"2026-09-30T23:46:00Z"}},"related_cves":[],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:3a4c5172-6df9-4615-8058-5e2f474fbac1","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6623-4q32-82v8","advisory_id":"3a4c5172-6df9-4615-8058-5e2f474fbac1","event_types":["withdrawal"],"published_at":"2026-10-25T14:31:51.131021+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-19T12:32:10+00:00","detail_url":"/events/51913"}]}},{"id":31213,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-4682-632p-x7r6","summary":"CGA-4682-632p-x7r6","evidence":"osv:CGA-4682-632p-x7r6","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-4682-632p-x7r6","aliases":["CGA-4682-632p-x7r6"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4682-632p-x7r6.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-29T01:43:57Z"}]}}],"modified":"2026-09-29T18:24:40.828076178Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56764.json","https://github.com/honojs/hono/security/advisories/GHSA-gq3j-xvxp-8hrf","https://nvd.nist.gov/vuln/detail/CVE-2026-56764","https://www.vulncheck.com/advisories/hono-timing-attack-in-basicauth-and-bearerauth-middleware"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:368886c2-3e1a-437f-b3ba-d9e583cbcee2","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4682-632p-x7r6","advisory_id":"368886c2-3e1a-437f-b3ba-d9e583cbcee2","event_types":["advisory"],"published_at":"2026-10-25T08:24:49.742446+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:35:20+00:00","detail_url":"/advisories/advisory%3A368886c2-3e1a-437f-b3ba-d9e583cbcee2","group":{"id":"advisory:368886c2-3e1a-437f-b3ba-d9e583cbcee2","revision":1,"primary_event_id":30959,"change":"published","superseded_by":[],"changed":{"id":30959,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-4682-632p-x7r6","summary":"CGA-4682-632p-x7r6","evidence":"osv:CGA-4682-632p-x7r6","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-4682-632p-x7r6","aliases":["CGA-4682-632p-x7r6"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4682-632p-x7r6.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-29T01:43:57Z"}]}}],"modified":"2026-09-29T18:24:40.828076178Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56764.json","https://github.com/honojs/hono/security/advisories/GHSA-gq3j-xvxp-8hrf","https://nvd.nist.gov/vuln/detail/CVE-2026-56764","https://www.vulncheck.com/advisories/hono-timing-attack-in-basicauth-and-bearerauth-middleware"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:368886c2-3e1a-437f-b3ba-d9e583cbcee2","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4682-632p-x7r6","advisory_id":"368886c2-3e1a-437f-b3ba-d9e583cbcee2","event_types":["advisory"],"published_at":"2026-10-25T08:24:49.742446+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:35:20+00:00","detail_url":"/events/30959"},"members":[{"id":30959,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-4682-632p-x7r6","summary":"CGA-4682-632p-x7r6","evidence":"osv:CGA-4682-632p-x7r6","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-4682-632p-x7r6","aliases":["CGA-4682-632p-x7r6"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4682-632p-x7r6.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-29T01:43:57Z"}]}}],"modified":"2026-09-29T18:24:40.828076178Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56764.json","https://github.com/honojs/hono/security/advisories/GHSA-gq3j-xvxp-8hrf","https://nvd.nist.gov/vuln/detail/CVE-2026-56764","https://www.vulncheck.com/advisories/hono-timing-attack-in-basicauth-and-bearerauth-middleware"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:368886c2-3e1a-437f-b3ba-d9e583cbcee2","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4682-632p-x7r6","advisory_id":"368886c2-3e1a-437f-b3ba-d9e583cbcee2","event_types":["advisory"],"published_at":"2026-10-25T08:24:49.742446+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:35:20+00:00","detail_url":"/events/30959"}]}},{"id":24215,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-7qrg-mr89-9cgf","summary":"CGA-7qrg-mr89-9cgf","evidence":"osv:CGA-7qrg-mr89-9cgf","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7qrg-mr89-9cgf","aliases":["CGA-7qrg-mr89-9cgf"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7qrg-mr89-9cgf.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-29T01:43:57Z"}]}}],"modified":"2026-09-29T04:15:57.756667424Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56762.json","https://github.com/honojs/hono/security/advisories/GHSA-26pp-8wgv-hjvm","https://nvd.nist.gov/vuln/detail/CVE-2026-56762","https://www.vulncheck.com/advisories/hono-missing-cookie-name-validation-in-setcookie"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b3d72262-389e-4cee-8ff1-eaadec5f8db2","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7qrg-mr89-9cgf","advisory_id":"b3d72262-389e-4cee-8ff1-eaadec5f8db2","event_types":["advisory"],"published_at":"2026-10-25T06:29:15.5411+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:35:19+00:00","detail_url":"/advisories/advisory%3Ab3d72262-389e-4cee-8ff1-eaadec5f8db2","group":{"id":"advisory:b3d72262-389e-4cee-8ff1-eaadec5f8db2","revision":1,"primary_event_id":24053,"change":"published","superseded_by":[],"changed":{"id":24053,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-7qrg-mr89-9cgf","summary":"CGA-7qrg-mr89-9cgf","evidence":"osv:CGA-7qrg-mr89-9cgf","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7qrg-mr89-9cgf","aliases":["CGA-7qrg-mr89-9cgf"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7qrg-mr89-9cgf.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-29T01:43:57Z"}]}}],"modified":"2026-09-29T04:15:57.756667424Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56762.json","https://github.com/honojs/hono/security/advisories/GHSA-26pp-8wgv-hjvm","https://nvd.nist.gov/vuln/detail/CVE-2026-56762","https://www.vulncheck.com/advisories/hono-missing-cookie-name-validation-in-setcookie"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b3d72262-389e-4cee-8ff1-eaadec5f8db2","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7qrg-mr89-9cgf","advisory_id":"b3d72262-389e-4cee-8ff1-eaadec5f8db2","event_types":["advisory"],"published_at":"2026-10-25T06:29:15.5411+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:35:19+00:00","detail_url":"/events/24053"},"members":[{"id":24053,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-7qrg-mr89-9cgf","summary":"CGA-7qrg-mr89-9cgf","evidence":"osv:CGA-7qrg-mr89-9cgf","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7qrg-mr89-9cgf","aliases":["CGA-7qrg-mr89-9cgf"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7qrg-mr89-9cgf.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-29T01:43:57Z"}]}}],"modified":"2026-09-29T04:15:57.756667424Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56762.json","https://github.com/honojs/hono/security/advisories/GHSA-26pp-8wgv-hjvm","https://nvd.nist.gov/vuln/detail/CVE-2026-56762","https://www.vulncheck.com/advisories/hono-missing-cookie-name-validation-in-setcookie"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b3d72262-389e-4cee-8ff1-eaadec5f8db2","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7qrg-mr89-9cgf","advisory_id":"b3d72262-389e-4cee-8ff1-eaadec5f8db2","event_types":["advisory"],"published_at":"2026-10-25T06:29:15.5411+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:35:19+00:00","detail_url":"/events/24053"}]}},{"id":23478,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-xfrr-9c5c-68c8","summary":"CGA-xfrr-9c5c-68c8","evidence":"osv:CGA-xfrr-9c5c-68c8","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-xfrr-9c5c-68c8","aliases":["CGA-xfrr-9c5c-68c8"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xfrr-9c5c-68c8.json"},"ecosystem_specific":{"components":[{"component_name":"jline-builtins","component_purl":"pkg:maven/jline-builtins","component_type":"java-archive","component_version":"","component_location":"/usr/share/java/hono-cli/hono-cli.jar","latest_event_status":"false_positive_determination","latest_event_timestamp":"2026-09-28T10:42:58Z"}]}}],"modified":"2026-09-28T16:46:29.048165712Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77422.json","https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15","https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw","https://nvd.nist.gov/vuln/detail/CVE-2026-77422"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4a0a9ca7-338e-4de9-8810-3aeae8d5b44c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xfrr-9c5c-68c8","advisory_id":"4a0a9ca7-338e-4de9-8810-3aeae8d5b44c","event_types":["advisory"],"published_at":"2026-10-25T06:16:04.777814+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:58:06+00:00","detail_url":"/advisories/advisory%3A4a0a9ca7-338e-4de9-8810-3aeae8d5b44c","group":{"id":"advisory:4a0a9ca7-338e-4de9-8810-3aeae8d5b44c","revision":1,"primary_event_id":23304,"change":"published","superseded_by":[],"changed":{"id":23304,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-xfrr-9c5c-68c8","summary":"CGA-xfrr-9c5c-68c8","evidence":"osv:CGA-xfrr-9c5c-68c8","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-xfrr-9c5c-68c8","aliases":["CGA-xfrr-9c5c-68c8"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xfrr-9c5c-68c8.json"},"ecosystem_specific":{"components":[{"component_name":"jline-builtins","component_purl":"pkg:maven/jline-builtins","component_type":"java-archive","component_version":"","component_location":"/usr/share/java/hono-cli/hono-cli.jar","latest_event_status":"false_positive_determination","latest_event_timestamp":"2026-09-28T10:42:58Z"}]}}],"modified":"2026-09-28T16:46:29.048165712Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77422.json","https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15","https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw","https://nvd.nist.gov/vuln/detail/CVE-2026-77422"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4a0a9ca7-338e-4de9-8810-3aeae8d5b44c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xfrr-9c5c-68c8","advisory_id":"4a0a9ca7-338e-4de9-8810-3aeae8d5b44c","event_types":["advisory"],"published_at":"2026-10-25T06:16:04.777814+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:58:06+00:00","detail_url":"/events/23304"},"members":[{"id":23304,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-xfrr-9c5c-68c8","summary":"CGA-xfrr-9c5c-68c8","evidence":"osv:CGA-xfrr-9c5c-68c8","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-xfrr-9c5c-68c8","aliases":["CGA-xfrr-9c5c-68c8"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xfrr-9c5c-68c8.json"},"ecosystem_specific":{"components":[{"component_name":"jline-builtins","component_purl":"pkg:maven/jline-builtins","component_type":"java-archive","component_version":"","component_location":"/usr/share/java/hono-cli/hono-cli.jar","latest_event_status":"false_positive_determination","latest_event_timestamp":"2026-09-28T10:42:58Z"}]}}],"modified":"2026-09-28T16:46:29.048165712Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77422.json","https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15","https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw","https://nvd.nist.gov/vuln/detail/CVE-2026-77422"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4a0a9ca7-338e-4de9-8810-3aeae8d5b44c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xfrr-9c5c-68c8","advisory_id":"4a0a9ca7-338e-4de9-8810-3aeae8d5b44c","event_types":["advisory"],"published_at":"2026-10-25T06:16:04.777814+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:58:06+00:00","detail_url":"/events/23304"}]}},{"id":22915,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-mpg6-2qr8-r38m","summary":"CGA-mpg6-2qr8-r38m","evidence":"osv:CGA-mpg6-2qr8-r38m","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-mpg6-2qr8-r38m","aliases":["CGA-mpg6-2qr8-r38m"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mpg6-2qr8-r38m.json"},"ecosystem_specific":{"components":[{"component_name":"jline-builtins","component_purl":"pkg:maven/jline-builtins","component_type":"java-archive","component_version":"","component_location":"/usr/share/java/hono-cli/hono-cli.jar","latest_event_status":"false_positive_determination","latest_event_timestamp":"2026-09-28T10:43:06Z"}]}}],"modified":"2026-09-28T16:46:11.135593355Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77422.json","https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15","https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw","https://nvd.nist.gov/vuln/detail/CVE-2026-77422"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d5c57ec3-a693-4d8e-a3ac-aaf9f14331c8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mpg6-2qr8-r38m","advisory_id":"d5c57ec3-a693-4d8e-a3ac-aaf9f14331c8","event_types":["advisory"],"published_at":"2026-10-25T06:07:11.867421+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:58:06+00:00","detail_url":"/advisories/advisory%3Ad5c57ec3-a693-4d8e-a3ac-aaf9f14331c8","group":{"id":"advisory:d5c57ec3-a693-4d8e-a3ac-aaf9f14331c8","revision":1,"primary_event_id":22750,"change":"published","superseded_by":[],"changed":{"id":22750,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-mpg6-2qr8-r38m","summary":"CGA-mpg6-2qr8-r38m","evidence":"osv:CGA-mpg6-2qr8-r38m","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-mpg6-2qr8-r38m","aliases":["CGA-mpg6-2qr8-r38m"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mpg6-2qr8-r38m.json"},"ecosystem_specific":{"components":[{"component_name":"jline-builtins","component_purl":"pkg:maven/jline-builtins","component_type":"java-archive","component_version":"","component_location":"/usr/share/java/hono-cli/hono-cli.jar","latest_event_status":"false_positive_determination","latest_event_timestamp":"2026-09-28T10:43:06Z"}]}}],"modified":"2026-09-28T16:46:11.135593355Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77422.json","https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15","https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw","https://nvd.nist.gov/vuln/detail/CVE-2026-77422"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d5c57ec3-a693-4d8e-a3ac-aaf9f14331c8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mpg6-2qr8-r38m","advisory_id":"d5c57ec3-a693-4d8e-a3ac-aaf9f14331c8","event_types":["advisory"],"published_at":"2026-10-25T06:07:11.867421+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:58:06+00:00","detail_url":"/events/22750"},"members":[{"id":22750,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-mpg6-2qr8-r38m","summary":"CGA-mpg6-2qr8-r38m","evidence":"osv:CGA-mpg6-2qr8-r38m","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-mpg6-2qr8-r38m","aliases":["CGA-mpg6-2qr8-r38m"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mpg6-2qr8-r38m.json"},"ecosystem_specific":{"components":[{"component_name":"jline-builtins","component_purl":"pkg:maven/jline-builtins","component_type":"java-archive","component_version":"","component_location":"/usr/share/java/hono-cli/hono-cli.jar","latest_event_status":"false_positive_determination","latest_event_timestamp":"2026-09-28T10:43:06Z"}]}}],"modified":"2026-09-28T16:46:11.135593355Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77422.json","https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15","https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw","https://nvd.nist.gov/vuln/detail/CVE-2026-77422"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d5c57ec3-a693-4d8e-a3ac-aaf9f14331c8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mpg6-2qr8-r38m","advisory_id":"d5c57ec3-a693-4d8e-a3ac-aaf9f14331c8","event_types":["advisory"],"published_at":"2026-10-25T06:07:11.867421+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:58:06+00:00","detail_url":"/events/22750"}]}},{"id":22540,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-prpp-jrxq-6463","summary":"CGA-prpp-jrxq-6463","evidence":"osv:CGA-prpp-jrxq-6463","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-prpp-jrxq-6463","aliases":["CGA-prpp-jrxq-6463"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-prpp-jrxq-6463.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T07:21:11Z"}]}}],"modified":"2026-09-28T10:15:10.981835523Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56762.json","https://github.com/honojs/hono/security/advisories/GHSA-26pp-8wgv-hjvm","https://nvd.nist.gov/vuln/detail/CVE-2026-56762","https://www.vulncheck.com/advisories/hono-missing-cookie-name-validation-in-setcookie"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c869ee64-147c-4204-916c-ed86235a782a","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-prpp-jrxq-6463","advisory_id":"c869ee64-147c-4204-916c-ed86235a782a","event_types":["advisory"],"published_at":"2026-10-25T06:00:45.888041+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T04:03:55+00:00","detail_url":"/advisories/advisory%3Ac869ee64-147c-4204-916c-ed86235a782a","group":{"id":"advisory:c869ee64-147c-4204-916c-ed86235a782a","revision":1,"primary_event_id":22378,"change":"published","superseded_by":[],"changed":{"id":22378,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-prpp-jrxq-6463","summary":"CGA-prpp-jrxq-6463","evidence":"osv:CGA-prpp-jrxq-6463","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-prpp-jrxq-6463","aliases":["CGA-prpp-jrxq-6463"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-prpp-jrxq-6463.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T07:21:11Z"}]}}],"modified":"2026-09-28T10:15:10.981835523Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56762.json","https://github.com/honojs/hono/security/advisories/GHSA-26pp-8wgv-hjvm","https://nvd.nist.gov/vuln/detail/CVE-2026-56762","https://www.vulncheck.com/advisories/hono-missing-cookie-name-validation-in-setcookie"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c869ee64-147c-4204-916c-ed86235a782a","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-prpp-jrxq-6463","advisory_id":"c869ee64-147c-4204-916c-ed86235a782a","event_types":["advisory"],"published_at":"2026-10-25T06:00:45.888041+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T04:03:55+00:00","detail_url":"/events/22378"},"members":[{"id":22378,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-prpp-jrxq-6463","summary":"CGA-prpp-jrxq-6463","evidence":"osv:CGA-prpp-jrxq-6463","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-prpp-jrxq-6463","aliases":["CGA-prpp-jrxq-6463"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-prpp-jrxq-6463.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T07:21:11Z"}]}}],"modified":"2026-09-28T10:15:10.981835523Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56762.json","https://github.com/honojs/hono/security/advisories/GHSA-26pp-8wgv-hjvm","https://nvd.nist.gov/vuln/detail/CVE-2026-56762","https://www.vulncheck.com/advisories/hono-missing-cookie-name-validation-in-setcookie"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c869ee64-147c-4204-916c-ed86235a782a","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-prpp-jrxq-6463","advisory_id":"c869ee64-147c-4204-916c-ed86235a782a","event_types":["advisory"],"published_at":"2026-10-25T06:00:45.888041+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T04:03:55+00:00","detail_url":"/events/22378"}]}},{"id":22520,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-3j9w-fpc3-gw88","summary":"CGA-3j9w-fpc3-gw88","evidence":"osv:CGA-3j9w-fpc3-gw88","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3j9w-fpc3-gw88","aliases":["CGA-3j9w-fpc3-gw88"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3j9w-fpc3-gw88.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T07:21:11Z"}]}}],"modified":"2026-09-28T10:15:08.968722273Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56764.json","https://github.com/honojs/hono/security/advisories/GHSA-gq3j-xvxp-8hrf","https://nvd.nist.gov/vuln/detail/CVE-2026-56764","https://www.vulncheck.com/advisories/hono-timing-attack-in-basicauth-and-bearerauth-middleware"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:acbf231b-15d1-4625-850d-31cc3a11eeb3","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3j9w-fpc3-gw88","advisory_id":"acbf231b-15d1-4625-850d-31cc3a11eeb3","event_types":["advisory"],"published_at":"2026-10-25T06:00:28.116812+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T04:03:56+00:00","detail_url":"/advisories/advisory%3Aacbf231b-15d1-4625-850d-31cc3a11eeb3","group":{"id":"advisory:acbf231b-15d1-4625-850d-31cc3a11eeb3","revision":1,"primary_event_id":22358,"change":"published","superseded_by":[],"changed":{"id":22358,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-3j9w-fpc3-gw88","summary":"CGA-3j9w-fpc3-gw88","evidence":"osv:CGA-3j9w-fpc3-gw88","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3j9w-fpc3-gw88","aliases":["CGA-3j9w-fpc3-gw88"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3j9w-fpc3-gw88.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T07:21:11Z"}]}}],"modified":"2026-09-28T10:15:08.968722273Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56764.json","https://github.com/honojs/hono/security/advisories/GHSA-gq3j-xvxp-8hrf","https://nvd.nist.gov/vuln/detail/CVE-2026-56764","https://www.vulncheck.com/advisories/hono-timing-attack-in-basicauth-and-bearerauth-middleware"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:acbf231b-15d1-4625-850d-31cc3a11eeb3","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3j9w-fpc3-gw88","advisory_id":"acbf231b-15d1-4625-850d-31cc3a11eeb3","event_types":["advisory"],"published_at":"2026-10-25T06:00:28.116812+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T04:03:56+00:00","detail_url":"/events/22358"},"members":[{"id":22358,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-3j9w-fpc3-gw88","summary":"CGA-3j9w-fpc3-gw88","evidence":"osv:CGA-3j9w-fpc3-gw88","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3j9w-fpc3-gw88","aliases":["CGA-3j9w-fpc3-gw88"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono","purl":"pkg:apk/chainguard/hono?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3j9w-fpc3-gw88.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:apk/hono@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T07:21:11Z"}]}}],"modified":"2026-09-28T10:15:08.968722273Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56764.json","https://github.com/honojs/hono/security/advisories/GHSA-gq3j-xvxp-8hrf","https://nvd.nist.gov/vuln/detail/CVE-2026-56764","https://www.vulncheck.com/advisories/hono-timing-attack-in-basicauth-and-bearerauth-middleware"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:acbf231b-15d1-4625-850d-31cc3a11eeb3","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3j9w-fpc3-gw88","advisory_id":"acbf231b-15d1-4625-850d-31cc3a11eeb3","event_types":["advisory"],"published_at":"2026-10-25T06:00:28.116812+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T04:03:56+00:00","detail_url":"/events/22358"}]}},{"id":21244,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-3479-a34e-1fda","summary":"ECHO-3479-a34e-1fda","evidence":"osv:ECHO-3479-a34e-1fda","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.34","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-3479-a34e-1fda","aliases":["ECHO-3479-a34e-1fda"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.34"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-3479-a34e-1fda.json"}}],"modified":"2026-09-28T00:46:06.130173785Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-71848"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1859d94b-1281-4280-b91c-895e48abfe2d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-3479-a34e-1fda","advisory_id":"1859d94b-1281-4280-b91c-895e48abfe2d","event_types":["advisory"],"published_at":"2026-10-25T05:39:38.564225+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/advisories/advisory%3A1859d94b-1281-4280-b91c-895e48abfe2d","group":{"id":"advisory:1859d94b-1281-4280-b91c-895e48abfe2d","revision":1,"primary_event_id":21096,"change":"published","superseded_by":[],"changed":{"id":21096,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-3479-a34e-1fda","summary":"ECHO-3479-a34e-1fda","evidence":"osv:ECHO-3479-a34e-1fda","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.34","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-3479-a34e-1fda","aliases":["ECHO-3479-a34e-1fda"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.34"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-3479-a34e-1fda.json"}}],"modified":"2026-09-28T00:46:06.130173785Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-71848"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1859d94b-1281-4280-b91c-895e48abfe2d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-3479-a34e-1fda","advisory_id":"1859d94b-1281-4280-b91c-895e48abfe2d","event_types":["advisory"],"published_at":"2026-10-25T05:39:38.564225+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/21096"},"members":[{"id":21096,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-3479-a34e-1fda","summary":"ECHO-3479-a34e-1fda","evidence":"osv:ECHO-3479-a34e-1fda","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.34","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-3479-a34e-1fda","aliases":["ECHO-3479-a34e-1fda"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.34"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-3479-a34e-1fda.json"}}],"modified":"2026-09-28T00:46:06.130173785Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-71848"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1859d94b-1281-4280-b91c-895e48abfe2d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-3479-a34e-1fda","advisory_id":"1859d94b-1281-4280-b91c-895e48abfe2d","event_types":["advisory"],"published_at":"2026-10-25T05:39:38.564225+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/21096"}]}},{"id":21242,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-f837-bbec-a395","summary":"ECHO-f837-bbec-a395","evidence":"osv:ECHO-f837-bbec-a395","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.34","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-f837-bbec-a395","aliases":["ECHO-f837-bbec-a395"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.34"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-f837-bbec-a395.json"}}],"modified":"2026-09-28T00:46:06.131188345Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-71850"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f6b319c5-0699-4a28-9b22-7c1ff90feac0","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-f837-bbec-a395","advisory_id":"f6b319c5-0699-4a28-9b22-7c1ff90feac0","event_types":["advisory"],"published_at":"2026-10-25T05:39:37.905666+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/advisories/advisory%3Af6b319c5-0699-4a28-9b22-7c1ff90feac0","group":{"id":"advisory:f6b319c5-0699-4a28-9b22-7c1ff90feac0","revision":1,"primary_event_id":21095,"change":"published","superseded_by":[],"changed":{"id":21095,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-f837-bbec-a395","summary":"ECHO-f837-bbec-a395","evidence":"osv:ECHO-f837-bbec-a395","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.34","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-f837-bbec-a395","aliases":["ECHO-f837-bbec-a395"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.34"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-f837-bbec-a395.json"}}],"modified":"2026-09-28T00:46:06.131188345Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-71850"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f6b319c5-0699-4a28-9b22-7c1ff90feac0","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-f837-bbec-a395","advisory_id":"f6b319c5-0699-4a28-9b22-7c1ff90feac0","event_types":["advisory"],"published_at":"2026-10-25T05:39:37.905666+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/21095"},"members":[{"id":21095,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-f837-bbec-a395","summary":"ECHO-f837-bbec-a395","evidence":"osv:ECHO-f837-bbec-a395","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.34","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-f837-bbec-a395","aliases":["ECHO-f837-bbec-a395"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.34"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-f837-bbec-a395.json"}}],"modified":"2026-09-28T00:46:06.131188345Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-71850"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f6b319c5-0699-4a28-9b22-7c1ff90feac0","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-f837-bbec-a395","advisory_id":"f6b319c5-0699-4a28-9b22-7c1ff90feac0","event_types":["advisory"],"published_at":"2026-10-25T05:39:37.905666+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/21095"}]}},{"id":21224,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-4b53-f5bc-1b65","summary":"ECHO-4b53-f5bc-1b65","evidence":"osv:ECHO-4b53-f5bc-1b65","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.34","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-4b53-f5bc-1b65","aliases":["ECHO-4b53-f5bc-1b65"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.34"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-4b53-f5bc-1b65.json"}}],"modified":"2026-09-28T00:46:02.713240982Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-69207"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9c4654dc-3145-4b67-81a2-65fac34fd298","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-4b53-f5bc-1b65","advisory_id":"9c4654dc-3145-4b67-81a2-65fac34fd298","event_types":["advisory"],"published_at":"2026-10-25T05:39:25.196071+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/advisories/advisory%3A9c4654dc-3145-4b67-81a2-65fac34fd298","group":{"id":"advisory:9c4654dc-3145-4b67-81a2-65fac34fd298","revision":1,"primary_event_id":21077,"change":"published","superseded_by":[],"changed":{"id":21077,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-4b53-f5bc-1b65","summary":"ECHO-4b53-f5bc-1b65","evidence":"osv:ECHO-4b53-f5bc-1b65","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.34","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-4b53-f5bc-1b65","aliases":["ECHO-4b53-f5bc-1b65"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.34"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-4b53-f5bc-1b65.json"}}],"modified":"2026-09-28T00:46:02.713240982Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-69207"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9c4654dc-3145-4b67-81a2-65fac34fd298","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-4b53-f5bc-1b65","advisory_id":"9c4654dc-3145-4b67-81a2-65fac34fd298","event_types":["advisory"],"published_at":"2026-10-25T05:39:25.196071+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/21077"},"members":[{"id":21077,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-4b53-f5bc-1b65","summary":"ECHO-4b53-f5bc-1b65","evidence":"osv:ECHO-4b53-f5bc-1b65","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.34","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-4b53-f5bc-1b65","aliases":["ECHO-4b53-f5bc-1b65"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.34"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-4b53-f5bc-1b65.json"}}],"modified":"2026-09-28T00:46:02.713240982Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-69207"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9c4654dc-3145-4b67-81a2-65fac34fd298","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-4b53-f5bc-1b65","advisory_id":"9c4654dc-3145-4b67-81a2-65fac34fd298","event_types":["advisory"],"published_at":"2026-10-25T05:39:25.196071+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/21077"}]}},{"id":21213,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-bd5b-948e-fdde","summary":"ECHO-bd5b-948e-fdde","evidence":"osv:ECHO-bd5b-948e-fdde","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.27","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-bd5b-948e-fdde","aliases":["ECHO-bd5b-948e-fdde"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.27"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-bd5b-948e-fdde.json"}}],"modified":"2026-09-28T00:46:01.595948315Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-59896","https://github.com/advisories/GHSA-hvrm-45r6-mjfj"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7058674a-0555-404e-b31a-6eed2a8436f8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-bd5b-948e-fdde","advisory_id":"7058674a-0555-404e-b31a-6eed2a8436f8","event_types":["advisory"],"published_at":"2026-10-25T05:38:30.006972+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/advisories/advisory%3A7058674a-0555-404e-b31a-6eed2a8436f8","group":{"id":"advisory:7058674a-0555-404e-b31a-6eed2a8436f8","revision":1,"primary_event_id":21066,"change":"published","superseded_by":[],"changed":{"id":21066,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-bd5b-948e-fdde","summary":"ECHO-bd5b-948e-fdde","evidence":"osv:ECHO-bd5b-948e-fdde","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.27","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-bd5b-948e-fdde","aliases":["ECHO-bd5b-948e-fdde"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.27"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-bd5b-948e-fdde.json"}}],"modified":"2026-09-28T00:46:01.595948315Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-59896","https://github.com/advisories/GHSA-hvrm-45r6-mjfj"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7058674a-0555-404e-b31a-6eed2a8436f8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-bd5b-948e-fdde","advisory_id":"7058674a-0555-404e-b31a-6eed2a8436f8","event_types":["advisory"],"published_at":"2026-10-25T05:38:30.006972+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/21066"},"members":[{"id":21066,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-bd5b-948e-fdde","summary":"ECHO-bd5b-948e-fdde","evidence":"osv:ECHO-bd5b-948e-fdde","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.27","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-bd5b-948e-fdde","aliases":["ECHO-bd5b-948e-fdde"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.27"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-bd5b-948e-fdde.json"}}],"modified":"2026-09-28T00:46:01.595948315Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-59896","https://github.com/advisories/GHSA-hvrm-45r6-mjfj"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7058674a-0555-404e-b31a-6eed2a8436f8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-bd5b-948e-fdde","advisory_id":"7058674a-0555-404e-b31a-6eed2a8436f8","event_types":["advisory"],"published_at":"2026-10-25T05:38:30.006972+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/21066"}]}},{"id":21212,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-f0d8-e683-de6b","summary":"ECHO-f0d8-e683-de6b","evidence":"osv:ECHO-f0d8-e683-de6b","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.27","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-f0d8-e683-de6b","aliases":["ECHO-f0d8-e683-de6b"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.27"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-f0d8-e683-de6b.json"}}],"modified":"2026-09-28T00:46:01.561641549Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-59897","https://github.com/advisories/GHSA-xgm2-5f3f-mvvc"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2a7131df-358b-4a6c-b441-71f7133cb1a8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-f0d8-e683-de6b","advisory_id":"2a7131df-358b-4a6c-b441-71f7133cb1a8","event_types":["advisory"],"published_at":"2026-10-25T05:38:29.431801+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/advisories/advisory%3A2a7131df-358b-4a6c-b441-71f7133cb1a8","group":{"id":"advisory:2a7131df-358b-4a6c-b441-71f7133cb1a8","revision":1,"primary_event_id":21065,"change":"published","superseded_by":[],"changed":{"id":21065,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-f0d8-e683-de6b","summary":"ECHO-f0d8-e683-de6b","evidence":"osv:ECHO-f0d8-e683-de6b","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.27","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-f0d8-e683-de6b","aliases":["ECHO-f0d8-e683-de6b"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.27"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-f0d8-e683-de6b.json"}}],"modified":"2026-09-28T00:46:01.561641549Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-59897","https://github.com/advisories/GHSA-xgm2-5f3f-mvvc"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2a7131df-358b-4a6c-b441-71f7133cb1a8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-f0d8-e683-de6b","advisory_id":"2a7131df-358b-4a6c-b441-71f7133cb1a8","event_types":["advisory"],"published_at":"2026-10-25T05:38:29.431801+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/21065"},"members":[{"id":21065,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-f0d8-e683-de6b","summary":"ECHO-f0d8-e683-de6b","evidence":"osv:ECHO-f0d8-e683-de6b","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.27","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-f0d8-e683-de6b","aliases":["ECHO-f0d8-e683-de6b"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.27"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-f0d8-e683-de6b.json"}}],"modified":"2026-09-28T00:46:01.561641549Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-59897","https://github.com/advisories/GHSA-xgm2-5f3f-mvvc"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2a7131df-358b-4a6c-b441-71f7133cb1a8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-f0d8-e683-de6b","advisory_id":"2a7131df-358b-4a6c-b441-71f7133cb1a8","event_types":["advisory"],"published_at":"2026-10-25T05:38:29.431801+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/21065"}]}},{"id":21211,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-7335-a8b9-129c","summary":"ECHO-7335-a8b9-129c","evidence":"osv:ECHO-7335-a8b9-129c","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.27","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-7335-a8b9-129c","aliases":["ECHO-7335-a8b9-129c"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.27"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-7335-a8b9-129c.json"}}],"modified":"2026-09-28T00:46:01.549694193Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-59895","https://github.com/advisories/GHSA-w62v-xxxg-mg59"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0658d3c1-c0f7-4501-9da1-8d3a3a500a71","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-7335-a8b9-129c","advisory_id":"0658d3c1-c0f7-4501-9da1-8d3a3a500a71","event_types":["advisory"],"published_at":"2026-10-25T05:38:28.741072+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/advisories/advisory%3A0658d3c1-c0f7-4501-9da1-8d3a3a500a71","group":{"id":"advisory:0658d3c1-c0f7-4501-9da1-8d3a3a500a71","revision":1,"primary_event_id":21064,"change":"published","superseded_by":[],"changed":{"id":21064,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-7335-a8b9-129c","summary":"ECHO-7335-a8b9-129c","evidence":"osv:ECHO-7335-a8b9-129c","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.27","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-7335-a8b9-129c","aliases":["ECHO-7335-a8b9-129c"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.27"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-7335-a8b9-129c.json"}}],"modified":"2026-09-28T00:46:01.549694193Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-59895","https://github.com/advisories/GHSA-w62v-xxxg-mg59"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0658d3c1-c0f7-4501-9da1-8d3a3a500a71","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-7335-a8b9-129c","advisory_id":"0658d3c1-c0f7-4501-9da1-8d3a3a500a71","event_types":["advisory"],"published_at":"2026-10-25T05:38:28.741072+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/21064"},"members":[{"id":21064,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-7335-a8b9-129c","summary":"ECHO-7335-a8b9-129c","evidence":"osv:ECHO-7335-a8b9-129c","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.27","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-7335-a8b9-129c","aliases":["ECHO-7335-a8b9-129c"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.27"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-7335-a8b9-129c.json"}}],"modified":"2026-09-28T00:46:01.549694193Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-59895","https://github.com/advisories/GHSA-w62v-xxxg-mg59"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0658d3c1-c0f7-4501-9da1-8d3a3a500a71","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-7335-a8b9-129c","advisory_id":"0658d3c1-c0f7-4501-9da1-8d3a3a500a71","event_types":["advisory"],"published_at":"2026-10-25T05:38:28.741072+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/21064"}]}},{"id":21199,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-972b-f731-a0eb","summary":"ECHO-972b-f731-a0eb","evidence":"osv:ECHO-972b-f731-a0eb","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.25","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-972b-f731-a0eb","aliases":["ECHO-972b-f731-a0eb"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.25"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-972b-f731-a0eb.json"}}],"modified":"2026-09-28T00:46:00.298704604Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-54288","https://github.com/advisories/GHSA-rv63-4mwf-qqc2"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:39e6bf33-4b0b-425a-a3e0-7facdee1b265","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-972b-f731-a0eb","advisory_id":"39e6bf33-4b0b-425a-a3e0-7facdee1b265","event_types":["advisory"],"published_at":"2026-10-25T05:38:22.050491+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/advisories/advisory%3A39e6bf33-4b0b-425a-a3e0-7facdee1b265","group":{"id":"advisory:39e6bf33-4b0b-425a-a3e0-7facdee1b265","revision":1,"primary_event_id":21052,"change":"published","superseded_by":[],"changed":{"id":21052,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-972b-f731-a0eb","summary":"ECHO-972b-f731-a0eb","evidence":"osv:ECHO-972b-f731-a0eb","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.25","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-972b-f731-a0eb","aliases":["ECHO-972b-f731-a0eb"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.25"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-972b-f731-a0eb.json"}}],"modified":"2026-09-28T00:46:00.298704604Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-54288","https://github.com/advisories/GHSA-rv63-4mwf-qqc2"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:39e6bf33-4b0b-425a-a3e0-7facdee1b265","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-972b-f731-a0eb","advisory_id":"39e6bf33-4b0b-425a-a3e0-7facdee1b265","event_types":["advisory"],"published_at":"2026-10-25T05:38:22.050491+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/21052"},"members":[{"id":21052,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-972b-f731-a0eb","summary":"ECHO-972b-f731-a0eb","evidence":"osv:ECHO-972b-f731-a0eb","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.25","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-972b-f731-a0eb","aliases":["ECHO-972b-f731-a0eb"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.25"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-972b-f731-a0eb.json"}}],"modified":"2026-09-28T00:46:00.298704604Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-54288","https://github.com/advisories/GHSA-rv63-4mwf-qqc2"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:39e6bf33-4b0b-425a-a3e0-7facdee1b265","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-972b-f731-a0eb","advisory_id":"39e6bf33-4b0b-425a-a3e0-7facdee1b265","event_types":["advisory"],"published_at":"2026-10-25T05:38:22.050491+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/21052"}]}},{"id":21196,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-55ba-b30a-0691","summary":"ECHO-55ba-b30a-0691","evidence":"osv:ECHO-55ba-b30a-0691","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.25","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-55ba-b30a-0691","aliases":["ECHO-55ba-b30a-0691"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.25"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-55ba-b30a-0691.json"}}],"modified":"2026-09-28T00:45:59.447326666Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-54287","https://github.com/advisories/GHSA-j6c9-x7qj-28xf"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:693691fb-cca1-458c-aae6-1c810b033045","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-55ba-b30a-0691","advisory_id":"693691fb-cca1-458c-aae6-1c810b033045","event_types":["advisory"],"published_at":"2026-10-25T05:38:20.038935+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/advisories/advisory%3A693691fb-cca1-458c-aae6-1c810b033045","group":{"id":"advisory:693691fb-cca1-458c-aae6-1c810b033045","revision":1,"primary_event_id":21049,"change":"published","superseded_by":[],"changed":{"id":21049,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-55ba-b30a-0691","summary":"ECHO-55ba-b30a-0691","evidence":"osv:ECHO-55ba-b30a-0691","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.25","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-55ba-b30a-0691","aliases":["ECHO-55ba-b30a-0691"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.25"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-55ba-b30a-0691.json"}}],"modified":"2026-09-28T00:45:59.447326666Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-54287","https://github.com/advisories/GHSA-j6c9-x7qj-28xf"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:693691fb-cca1-458c-aae6-1c810b033045","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-55ba-b30a-0691","advisory_id":"693691fb-cca1-458c-aae6-1c810b033045","event_types":["advisory"],"published_at":"2026-10-25T05:38:20.038935+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/21049"},"members":[{"id":21049,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-55ba-b30a-0691","summary":"ECHO-55ba-b30a-0691","evidence":"osv:ECHO-55ba-b30a-0691","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.25","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-55ba-b30a-0691","aliases":["ECHO-55ba-b30a-0691"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.25"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-55ba-b30a-0691.json"}}],"modified":"2026-09-28T00:45:59.447326666Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-54287","https://github.com/advisories/GHSA-j6c9-x7qj-28xf"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:693691fb-cca1-458c-aae6-1c810b033045","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-55ba-b30a-0691","advisory_id":"693691fb-cca1-458c-aae6-1c810b033045","event_types":["advisory"],"published_at":"2026-10-25T05:38:20.038935+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/21049"}]}},{"id":21187,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-22d9-65f9-d2a1","summary":"ECHO-22d9-65f9-d2a1","evidence":"osv:ECHO-22d9-65f9-d2a1","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.21","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-22d9-65f9-d2a1","aliases":["ECHO-22d9-65f9-d2a1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.21"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-22d9-65f9-d2a1.json"}}],"modified":"2026-09-28T00:45:57.788679906Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-47676","https://github.com/advisories/GHSA-2gcr-mfcq-wcc3"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1129a593-2cfe-4b9e-b52f-2f1fef224a2f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-22d9-65f9-d2a1","advisory_id":"1129a593-2cfe-4b9e-b52f-2f1fef224a2f","event_types":["advisory"],"published_at":"2026-10-25T05:38:15.785205+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/advisories/advisory%3A1129a593-2cfe-4b9e-b52f-2f1fef224a2f","group":{"id":"advisory:1129a593-2cfe-4b9e-b52f-2f1fef224a2f","revision":1,"primary_event_id":21040,"change":"published","superseded_by":[],"changed":{"id":21040,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-22d9-65f9-d2a1","summary":"ECHO-22d9-65f9-d2a1","evidence":"osv:ECHO-22d9-65f9-d2a1","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.21","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-22d9-65f9-d2a1","aliases":["ECHO-22d9-65f9-d2a1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.21"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-22d9-65f9-d2a1.json"}}],"modified":"2026-09-28T00:45:57.788679906Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-47676","https://github.com/advisories/GHSA-2gcr-mfcq-wcc3"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1129a593-2cfe-4b9e-b52f-2f1fef224a2f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-22d9-65f9-d2a1","advisory_id":"1129a593-2cfe-4b9e-b52f-2f1fef224a2f","event_types":["advisory"],"published_at":"2026-10-25T05:38:15.785205+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/21040"},"members":[{"id":21040,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-22d9-65f9-d2a1","summary":"ECHO-22d9-65f9-d2a1","evidence":"osv:ECHO-22d9-65f9-d2a1","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.21","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-22d9-65f9-d2a1","aliases":["ECHO-22d9-65f9-d2a1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.21"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-22d9-65f9-d2a1.json"}}],"modified":"2026-09-28T00:45:57.788679906Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-47676","https://github.com/advisories/GHSA-2gcr-mfcq-wcc3"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1129a593-2cfe-4b9e-b52f-2f1fef224a2f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-22d9-65f9-d2a1","advisory_id":"1129a593-2cfe-4b9e-b52f-2f1fef224a2f","event_types":["advisory"],"published_at":"2026-10-25T05:38:15.785205+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/21040"}]}},{"id":21165,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-a753-f273-abba","summary":"ECHO-a753-f273-abba","evidence":"osv:ECHO-a753-f273-abba","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.13.5","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-a753-f273-abba","aliases":["ECHO-a753-f273-abba"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.5"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-a753-f273-abba.json"}}],"modified":"2026-09-28T00:45:55.482304438Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-84365"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:98e38d4b-5844-4a2b-8696-a3acec20c87a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-a753-f273-abba","advisory_id":"98e38d4b-5844-4a2b-8696-a3acec20c87a","event_types":["advisory"],"published_at":"2026-10-25T05:38:02.957338+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/advisories/advisory%3A98e38d4b-5844-4a2b-8696-a3acec20c87a","group":{"id":"advisory:98e38d4b-5844-4a2b-8696-a3acec20c87a","revision":1,"primary_event_id":21018,"change":"published","superseded_by":[],"changed":{"id":21018,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-a753-f273-abba","summary":"ECHO-a753-f273-abba","evidence":"osv:ECHO-a753-f273-abba","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.13.5","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-a753-f273-abba","aliases":["ECHO-a753-f273-abba"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.5"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-a753-f273-abba.json"}}],"modified":"2026-09-28T00:45:55.482304438Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-84365"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:98e38d4b-5844-4a2b-8696-a3acec20c87a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-a753-f273-abba","advisory_id":"98e38d4b-5844-4a2b-8696-a3acec20c87a","event_types":["advisory"],"published_at":"2026-10-25T05:38:02.957338+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/21018"},"members":[{"id":21018,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-a753-f273-abba","summary":"ECHO-a753-f273-abba","evidence":"osv:ECHO-a753-f273-abba","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.13.5","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-a753-f273-abba","aliases":["ECHO-a753-f273-abba"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.5"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-a753-f273-abba.json"}}],"modified":"2026-09-28T00:45:55.482304438Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-84365"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:98e38d4b-5844-4a2b-8696-a3acec20c87a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-a753-f273-abba","advisory_id":"98e38d4b-5844-4a2b-8696-a3acec20c87a","event_types":["advisory"],"published_at":"2026-10-25T05:38:02.957338+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/21018"}]}},{"id":21158,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-48a8-f364-cd95","summary":"ECHO-48a8-f364-cd95","evidence":"osv:ECHO-48a8-f364-cd95","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.34","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-48a8-f364-cd95","aliases":["ECHO-48a8-f364-cd95"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.34"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-48a8-f364-cd95.json"}}],"modified":"2026-09-28T00:45:54.477205547Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-71849"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:54ccf9e1-ff9a-45b0-9ad0-65519d0b90e1","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-48a8-f364-cd95","advisory_id":"54ccf9e1-ff9a-45b0-9ad0-65519d0b90e1","event_types":["advisory"],"published_at":"2026-10-25T05:37:58.802574+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/advisories/advisory%3A54ccf9e1-ff9a-45b0-9ad0-65519d0b90e1","group":{"id":"advisory:54ccf9e1-ff9a-45b0-9ad0-65519d0b90e1","revision":1,"primary_event_id":21011,"change":"published","superseded_by":[],"changed":{"id":21011,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-48a8-f364-cd95","summary":"ECHO-48a8-f364-cd95","evidence":"osv:ECHO-48a8-f364-cd95","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.34","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-48a8-f364-cd95","aliases":["ECHO-48a8-f364-cd95"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.34"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-48a8-f364-cd95.json"}}],"modified":"2026-09-28T00:45:54.477205547Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-71849"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:54ccf9e1-ff9a-45b0-9ad0-65519d0b90e1","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-48a8-f364-cd95","advisory_id":"54ccf9e1-ff9a-45b0-9ad0-65519d0b90e1","event_types":["advisory"],"published_at":"2026-10-25T05:37:58.802574+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/21011"},"members":[{"id":21011,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-48a8-f364-cd95","summary":"ECHO-48a8-f364-cd95","evidence":"osv:ECHO-48a8-f364-cd95","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.34","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-48a8-f364-cd95","aliases":["ECHO-48a8-f364-cd95"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.34"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-48a8-f364-cd95.json"}}],"modified":"2026-09-28T00:45:54.477205547Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-71849"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:54ccf9e1-ff9a-45b0-9ad0-65519d0b90e1","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-48a8-f364-cd95","advisory_id":"54ccf9e1-ff9a-45b0-9ad0-65519d0b90e1","event_types":["advisory"],"published_at":"2026-10-25T05:37:58.802574+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/21011"}]}},{"id":21145,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-985a-be76-78fe","summary":"ECHO-985a-be76-78fe","evidence":"osv:ECHO-985a-be76-78fe","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.14","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-985a-be76-78fe","aliases":["ECHO-985a-be76-78fe"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-985a-be76-78fe.json"}}],"modified":"2026-09-28T00:45:52.026156111Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-56761","https://github.com/advisories/GHSA-458j-xx4x-4375"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:fde96281-390a-48d1-95a9-a399185cf26d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-985a-be76-78fe","advisory_id":"fde96281-390a-48d1-95a9-a399185cf26d","event_types":["advisory"],"published_at":"2026-10-25T05:37:51.292537+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/advisories/advisory%3Afde96281-390a-48d1-95a9-a399185cf26d","group":{"id":"advisory:fde96281-390a-48d1-95a9-a399185cf26d","revision":1,"primary_event_id":20998,"change":"published","superseded_by":[],"changed":{"id":20998,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-985a-be76-78fe","summary":"ECHO-985a-be76-78fe","evidence":"osv:ECHO-985a-be76-78fe","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.14","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-985a-be76-78fe","aliases":["ECHO-985a-be76-78fe"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-985a-be76-78fe.json"}}],"modified":"2026-09-28T00:45:52.026156111Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-56761","https://github.com/advisories/GHSA-458j-xx4x-4375"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:fde96281-390a-48d1-95a9-a399185cf26d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-985a-be76-78fe","advisory_id":"fde96281-390a-48d1-95a9-a399185cf26d","event_types":["advisory"],"published_at":"2026-10-25T05:37:51.292537+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/20998"},"members":[{"id":20998,"cve_ids":[],"payload":{"kind":"advisory","title":"ECHO-985a-be76-78fe","summary":"ECHO-985a-be76-78fe","evidence":"osv:ECHO-985a-be76-78fe","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.14","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"ECHO-985a-be76-78fe","aliases":["ECHO-985a-be76-78fe"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"Echo:npm"},"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-985a-be76-78fe.json"}}],"modified":"2026-09-28T00:45:52.026156111Z","provider":"osv","references":["https://advisory.echohq.com/cve/CVE-2026-56761","https://github.com/advisories/GHSA-458j-xx4x-4375"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:fde96281-390a-48d1-95a9-a399185cf26d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/ECHO-985a-be76-78fe","advisory_id":"fde96281-390a-48d1-95a9-a399185cf26d","event_types":["advisory"],"published_at":"2026-10-25T05:37:51.292537+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T00:01:57.5+00:00","detail_url":"/events/20998"}]}}],"next_after":75507,"next_before":21145}