An open index of dependabot pull requests across open source projects.

hono

Ecosystem:
npm
Package URL:
pkg:npm/hono
Total PRs:
15,917 Dependabot PRs
Latest PR:
about 14 hours ago
Unique Repositories:
5,729 repositories
Unique Repos (30 days):
366 repositories
Security Advisories
Hono vulnerable to Restricted Directory Traversal in serveStatic with deno
GHSA-3mpf-rcc7-5347 CVE-2024-32869 MODERATE published about 2 years ago • updated 5 days ago
### Summary When using serveStatic with deno, it is possible to directory traverse where main.ts is located. My environment is configured as per ...
hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR
GHSA-458j-xx4x-4375 CVE-2026-56761 MODERATE published 2 months ago • updated about 14 hours ago
## Summary Improper handling of JSX attribute names in hono/jsx allows malformed attribute keys to corrupt the generated HTML output. When untrus...
Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()
GHSA-r5rp-j6wh-rvv4 CVE-2026-39410 MODERATE published 3 months ago • updated 6 days ago
## Summary A discrepancy between browser cookie parsing and `parse()` handling allows cookie prefix protections to be bypassed. Cookie names that...
Hono: Path traversal in toSSG() allows writing files outside the output directory
GHSA-xf4j-xp2r-rqqx CVE-2026-39408 MODERATE published 3 months ago • updated 6 days ago
## Summary A path traversal issue in `toSSG()` allows files to be written outside the configured output directory during static site generation. W...
Hono missing validation of cookie name on write path in setCookie()
GHSA-26pp-8wgv-hjvm MODERATE published 3 months ago • updated 3 months ago
## Summary Cookie names are not validated on the write path when using `setCookie()`, `serialize()`, or `serializeSigned()` to generate Set-Cookie...
Recent PRs
Bump hono from 4.12.23 to 4.12.26

BASIC-BIT/drasil #157

4.12.23 → 4.12.26 Patch PR
Open 6 days ago 2 comments
BASIC-BIT
Bump hono from 4.12.23 to 4.12.26

zepa-ui/zepa #13

4.12.23 → 4.12.26 Patch PR
Open 7 days ago 1 comment
zepa-ui
Package Details
Name: hono
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/hono
JSON API: View JSON
Security Advisories

40

Active advisories
HIGH 7
MODERATE 30
LOW 3
View All npm Advisories
Package Information
Description:

Web framework built on Web Standards

Repository: https://github.com/honojs/hono
Homepage: https://hono.dev
Latest Release: 4.7.11
about 1 year ago
Dependent Repos: 668
Dependent Packages: 210
Downloads: 3,984,183
Ranking: Top 0.6913% by dependent repos Top 0.5184% by downloads Top 0.2201% by dependent pkgs
PR Status
Open 7,256 (45.6%)
Merged 812 (5.1%)
Closed 7,392 (46.4%)
PR Types
Major 283 (1.8%)
Minor 8,002 (50.3%)
Patch 7,174 (45.1%)
Removal 1 (0.0%)