Backend framework
Hono: latest release and open vulnerabilities today
The latest release of the hono package is 4.13.13. 6 high or critical advisories for the hono package were published in the last 12 months; none of its advisories is on CISA’s list of exploited vulnerabilities.
Last checked against npm, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.
- Latest hono release
- 4.13.13
- npm downloads last week
- 74M
- GitHub stars
- 32.5k
- Licence
- MIT
Security advisories
45 advisories published in the last 12 months, 6 of them high or critical. 51 in total since records began. Checked packages: hono.
hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard
Fixed in 4.12.25.
EPSS: top 76%Hono vulnerable to arbitrary file access via serveStatic vulnerability
Fixed in 4.12.4.
EPSS: top 52%Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
Fixed in 4.12.2.
EPSS: top 73%Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)
Fixed in 4.11.4.
EPSS: top 98%Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass
Fixed in 4.11.4.
EPSS: top 95%Hono Improper Authorization vulnerability
Fixed in 4.10.2.
EPSS: top 70%
Maintenance and supply chain
deps.dev has no OpenSSF Scorecard for this repository.
Docs and release notes
Check Hono in your own stack
This page checks Hono in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.