An open index of dependabot pull requests across open source projects.

hono

Ecosystem:
npm
Package URL:
pkg:npm/hono
Total PRs:
15,459 Dependabot PRs
Latest PR:
about 9 hours ago
Unique Repositories:
5,440 repositories
Unique Repos (30 days):
800 repositories
Security Advisories
Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage
GHSA-p77w-8qqv-26rm CVE-2026-44457 MODERATE published 22 days ago • updated 8 days ago
### Summary Cache Middleware does not skip caching for responses that declare per-user variance via `Vary: Authorization` or `Vary: Cookie`. As a ...
Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()
GHSA-hm8q-7f3q-5f36 CVE-2026-44459 LOW published 22 days ago • updated 8 days ago
### Summary Improper validation of the JWT NumericDate claims `exp`, `nbf`, and `iat` in `hono/utils/jwt` allows tokens with non-spec-compliant cl...
Named path parameters can be overridden in TrieRouter
GHSA-f6gv-hh8j-q8vq CVE-2023-50710 MODERATE published over 2 years ago • updated 33 minutes ago
### Impact The clients may override named path parameter values from previous requests if the application is using TrieRouter. So, there is a risk...
Hono: Path traversal in toSSG() allows writing files outside the output directory
GHSA-xf4j-xp2r-rqqx CVE-2026-39408 MODERATE published about 2 months ago • updated 10 days ago
## Summary A path traversal issue in `toSSG()` allows files to be written outside the configured output directory during static site generation. W...
Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing
GHSA-r354-f388-2fhh CVE-2026-24398 MODERATE published 4 months ago • updated about 22 hours ago
## Summary IP Restriction Middleware in Hono is vulnerable to an IP address validation bypass. The `IPV4_REGEX` pattern and `convertIPv4ToBinary` ...
Recent PRs (filtered by: Patch PRs )
chore(deps): bump hono from 4.12.21 to 4.12.22

Dargon789/appkit #1172

4.12.21 → 4.12.22 Patch PR
Open about 9 hours ago 6 comments
Dargon789
Bump hono from 4.12.4 to 4.12.23

amirwebd3v/Flowcv-mcp #3

4.12.4 → 4.12.23 Patch PR
Closed about 13 hours ago 1 comment
amirwebd3v
Package Details
Name: hono
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/hono
JSON API: View JSON
Security Advisories

31

Active advisories
HIGH 6
MODERATE 22
LOW 3
View All npm Advisories
Package Information
Description:

Web framework built on Web Standards

Repository: https://github.com/honojs/hono
Homepage: https://hono.dev
Latest Release: 4.7.11
12 months ago
Dependent Repos: 668
Dependent Packages: 210
Downloads: 3,984,183
Ranking: Top 0.6913% by dependent repos Top 0.5184% by downloads Top 0.2201% by dependent pkgs
PR Status
Open 7,087 (45.8%)
Merged 811 (5.2%)
Closed 7,107 (46.0%)
PR Types
Major 283 (1.8%)
Minor 7,914 (51.2%)
Patch 6,808 (44.0%)