{ "@id": "urn:uuid:15dc349f-daaf-42cb-a009-07db3fa7fef9", "role": "Document Creator", "author": "https://tuxcare.com", "version": 22, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T19:55:26.538286+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2023-50710 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2023-50710" }, "action_statement": "Vulnerability CVE-2023-50710 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-32869 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2024-32869" }, "action_statement": "Vulnerability CVE-2024-32869 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-43787 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2024-43787" }, "action_statement": "Vulnerability CVE-2024-43787 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-48913 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2024-48913" }, "action_statement": "Vulnerability CVE-2024-48913 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-58362 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2025-58362" }, "action_statement": "Vulnerability CVE-2025-58362 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-59139 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2025-59139" }, "action_statement": "Vulnerability CVE-2025-59139 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-62610 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2025-62610" }, "action_statement": "Vulnerability CVE-2025-62610 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-10-29T20:31:24.273560+00:00", "status_notes": "Vulnerability CVE-2025-71381 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2025-71381" }, "action_statement": "Vulnerability CVE-2025-71381 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-10-20T14:41:00.226982+00:00", "status_notes": "Vulnerability CVE-2026-111757 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-111757" }, "action_statement": "Vulnerability CVE-2026-111757 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-12T23:39:00.066400+00:00", "status_notes": "Vulnerability CVE-2026-126355 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-126355" }, "action_statement": "Vulnerability CVE-2026-126355 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-12T23:39:00.066400+00:00", "status_notes": "Vulnerability CVE-2026-126356 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-126356" }, "action_statement": "Vulnerability CVE-2026-126356 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126357 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-126357" }, "action_statement": "Vulnerability CVE-2026-126357 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126358 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-126358" }, "action_statement": "Vulnerability CVE-2026-126358 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126359 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-126359" }, "action_statement": "Vulnerability CVE-2026-126359 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-22817 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-22817" }, "action_statement": "Vulnerability CVE-2026-22817 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-22818 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-22818" }, "action_statement": "Vulnerability CVE-2026-22818 affects version 4.12.14 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-13T19:50:07.658643+00:00", "status_notes": "Vulnerability CVE-2026-24398 does not affect version 4.12.14 of hono. not_affected \u2014 hono 4.12.14 already contains the upstream fix for CVE-2026-24398. IPV4_REGEX in src/utils/ipaddr.ts now builds each octet from a strict 0-255 pattern (IPV4_OCTET_PART). An address such as 1.2.2.355 is therefore rejected before convertIPv4ToBinary runs. The fix commit edbf6eea was authored upstream by Yusuke Wada (yusuke@kamawada.com). It is an ancestor of the upstream release commit cf2d2b7e t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24398" }, "impact_statement": "not_affected \u2014 hono 4.12.14 already contains the upstream fix for CVE-2026-24398. IPV4_REGEX in src/utils/ipaddr.ts now builds each octet from a strict 0-255 pattern (IPV4_OCTET_PART). An address such as 1.2.2.355 is therefore rejected before convertIPv4ToBinary runs. The fix commit edbf6eea was authored upstream by Yusuke Wada (yusuke@kamawada.com). It is an ancestor of the upstream release commit cf2d2b7e t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-13T19:47:35.365109+00:00", "status_notes": "Vulnerability CVE-2026-24472 does not affect version 4.12.14 of hono. not_affected \u2014 hono 4.12.14 already contains the upstream fix for CVE-2026-24472. The fix is commit 12c511745b3f1e7a3f863a23ce5f921c7fa805d1 (author simon@koeck.dev, committer noreply@github.com). That commit is an ancestor of the upstream 4.12.14 release commit cf2d2b7e. src/middleware/cache/index.ts shouldSkipCache() skips caching on Cache-Control private/no-store/no-cache, Vary: * and Set-Cookie.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24472" }, "impact_statement": "not_affected \u2014 hono 4.12.14 already contains the upstream fix for CVE-2026-24472. The fix is commit 12c511745b3f1e7a3f863a23ce5f921c7fa805d1 (author simon@koeck.dev, committer noreply@github.com). That commit is an ancestor of the upstream 4.12.14 release commit cf2d2b7e. src/middleware/cache/index.ts shouldSkipCache() skips caching on Cache-Control private/no-store/no-cache, Vary: * and Set-Cookie." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-13T19:51:00.041863+00:00", "status_notes": "Vulnerability CVE-2026-24473 does not affect version 4.12.14 of hono. not_affected \u2014 The upstream fix for CVE-2026-24473 (hono commit cf9a78db) is already in the target. getContentFromKVAsset in src/adapter/cloudflare-workers/utils.ts now does `const key = ASSET_MANIFEST[path]` with no `|| path` fallback, so an unmapped request path can no longer be used as a raw KV key. The fix shipped in the upstream 4.12.14 release, before the first TuxCare commit, so the verdict is not_affe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24473" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-24473 (hono commit cf9a78db) is already in the target. getContentFromKVAsset in src/adapter/cloudflare-workers/utils.ts now does `const key = ASSET_MANIFEST[path]` with no `|| path` fallback, so an unmapped request path can no longer be used as a raw KV key. The fix shipped in the upstream 4.12.14 release, before the first TuxCare commit, so the verdict is not_affe..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-13T19:48:18.808255+00:00", "status_notes": "Vulnerability CVE-2026-24771 does not affect version 4.12.14 of hono. not_affected \u2014 hono 4.12.14 already contains the upstream fix for CVE-2026-24771 (upstream commit 2cf60046, \"Merge commit from fork\"). ErrorBoundary no longer forces untrusted strings into raw HTML. The fix shipped in the upstream release onboarded by TuxCare, and HEAD has no TuxCare-domain commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24771" }, "impact_statement": "not_affected \u2014 hono 4.12.14 already contains the upstream fix for CVE-2026-24771 (upstream commit 2cf60046, \"Merge commit from fork\"). ErrorBoundary no longer forces untrusted strings into raw HTML. The fix shipped in the upstream release onboarded by TuxCare, and HEAD has no TuxCare-domain commits." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-27700 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-27700" }, "action_statement": "Vulnerability CVE-2026-27700 affects version 4.12.14 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-13T19:46:17.356729+00:00", "status_notes": "Vulnerability CVE-2026-29045 does not affect version 4.12.14 of hono. not_affected \u2014 The upstream fix (commit 6a0607a9, author techfish-11, merged via GitHub) is already present in HEAD. serveStatic decodes the request path with tryDecodeURI, matching the router, so %2F stays encoded and cannot bypass route-based middleware. The fix shipped in the upstream 4.12.14 release, before any TuxCare commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29045" }, "impact_statement": "not_affected \u2014 The upstream fix (commit 6a0607a9, author techfish-11, merged via GitHub) is already present in HEAD. serveStatic decodes the request path with tryDecodeURI, matching the router, so %2F stays encoded and cannot bypass route-based middleware. The fix shipped in the upstream 4.12.14 release, before any TuxCare commits." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-13T19:51:00.041863+00:00", "status_notes": "Vulnerability CVE-2026-29085 does not affect version 4.12.14 of hono. not_affected \u2014 hono 4.12.14 already contains the upstream fix for CVE-2026-29085. SSEStreamingApi.writeSSE in src/helper/streaming/sse.ts rejects CR/LF in the event, id and retry fields before it builds the frame. The fix is upstream commit f4123ed9 by taku@taaas.jp. It is an ancestor of HEAD and shipped in the upstream release. HEAD has no commit from a TuxCare-domain author.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29085" }, "impact_statement": "not_affected \u2014 hono 4.12.14 already contains the upstream fix for CVE-2026-29085. SSEStreamingApi.writeSSE in src/helper/streaming/sse.ts rejects CR/LF in the event, id and retry fields before it builds the frame. The fix is upstream commit f4123ed9 by taku@taaas.jp. It is an ancestor of HEAD and shipped in the upstream release. HEAD has no commit from a TuxCare-domain author." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-13T19:49:46.782400+00:00", "status_notes": "Vulnerability CVE-2026-29086 does not affect version 4.12.14 of hono. not_affected \u2014 The target already contains the upstream fix for CVE-2026-29086. `_serialize()` in src/utils/cookie.ts rejects `;`, `\\r` and `\\n` in the `domain` and `path` options before building the Set-Cookie string. The fix commit is 44ae0c8c, authored by upstream (taku@taaas.jp), and it is an ancestor of HEAD. No TuxCare/CloudLinux-authored commit appears in HEAD's history, so the fix came with the upstre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29086" }, "impact_statement": "not_affected \u2014 The target already contains the upstream fix for CVE-2026-29086. `_serialize()` in src/utils/cookie.ts rejects `;`, `\\r` and `\\n` in the `domain` and `path` options before building the Set-Cookie string. The fix commit is 44ae0c8c, authored by upstream (taku@taaas.jp), and it is an ancestor of HEAD. No TuxCare/CloudLinux-authored commit appears in HEAD's history, so the fix came with the upstre..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-13T19:47:00.039124+00:00", "status_notes": "Vulnerability CVE-2026-39407 does not affect version 4.12.14 of hono. not_affected \u2014 hono 4.12.14 already contains the upstream fix for CVE-2026-39407. serveStatic rejects any decoded request path containing consecutive slashes or backslashes, so `//admin/secret.txt` is never resolved to a file. The fix is upstream commit 9aff14bd, authored by taku@taaas.jp and shipped in the 4.12.14 release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39407" }, "impact_statement": "not_affected \u2014 hono 4.12.14 already contains the upstream fix for CVE-2026-39407. serveStatic rejects any decoded request path containing consecutive slashes or backslashes, so `//admin/secret.txt` is never resolved to a file. The fix is upstream commit 9aff14bd, authored by taku@taaas.jp and shipped in the 4.12.14 release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-13T19:45:57.825172+00:00", "status_notes": "Vulnerability CVE-2026-39408 does not affect version 4.12.14 of hono. not_affected \u2014 The upstream fix for CVE-2026-39408 (hono commit b4702789) is already in the target at 4.12.14. generateFilePath() in src/helper/ssg/ssg.ts now calls ensureWithinOutDir(), which throws if the output path resolves outside the output directory. The fix is an ancestor of HEAD and part of the upstream release, so it is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39408" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-39408 (hono commit b4702789) is already in the target at 4.12.14. generateFilePath() in src/helper/ssg/ssg.ts now calls ensureWithinOutDir(), which throws if the output path resolves outside the output directory. The fix is an ancestor of HEAD and part of the upstream release, so it is not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-13T19:49:00.036571+00:00", "status_notes": "Vulnerability CVE-2026-39409 does not affect version 4.12.14 of hono. not_affected \u2014 hono 4.12.14 already contains the upstream fix for CVE-2026-39409 (commit 48fa2233, \"Merge commit from fork\"). ipRestriction() now canonicalizes IPv4-mapped IPv6 client addresses before matching IPv4 static and CIDR rules. The fix shipped in the upstream release, not through a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39409" }, "impact_statement": "not_affected \u2014 hono 4.12.14 already contains the upstream fix for CVE-2026-39409 (commit 48fa2233, \"Merge commit from fork\"). ipRestriction() now canonicalizes IPv4-mapped IPv6 client addresses before matching IPv4 static and CIDR rules. The fix shipped in the upstream release, not through a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-13T19:52:09.538868+00:00", "status_notes": "Vulnerability CVE-2026-39410 does not affect version 4.12.14 of hono. not_affected \u2014 The upstream fix for CVE-2026-39410 (hono commit cc067c85) is already in the 4.12.14 release. parse() in src/utils/cookie.ts trims only SP and HTAB, so U+00A0-prefixed cookie names no longer collapse onto legitimate names. The fix commit's author is upstream (taku@taaas.jp), and it predates the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39410" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-39410 (hono commit cc067c85) is already in the 4.12.14 release. parse() in src/utils/cookie.ts trims only SP and HTAB, so U+00A0-prefixed cookie names no longer collapse onto legitimate names. The fix commit's author is upstream (taku@taaas.jp), and it predates the first TuxCare commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44455 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-44455" }, "action_statement": "Vulnerability CVE-2026-44455 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44456 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-44456" }, "action_statement": "Vulnerability CVE-2026-44456 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44457 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-44457" }, "action_statement": "Vulnerability CVE-2026-44457 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44458 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-44458" }, "action_statement": "Vulnerability CVE-2026-44458 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44459 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-44459" }, "action_statement": "Vulnerability CVE-2026-44459 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47673 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-47673" }, "action_statement": "Vulnerability CVE-2026-47673 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47674 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-47674" }, "action_statement": "Vulnerability CVE-2026-47674 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47675 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-47675" }, "action_statement": "Vulnerability CVE-2026-47675 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47676 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-47676" }, "action_statement": "Vulnerability CVE-2026-47676 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54286 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-54286" }, "action_statement": "Vulnerability CVE-2026-54286 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54287 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-54287" }, "action_statement": "Vulnerability CVE-2026-54287 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54288 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-54288" }, "action_statement": "Vulnerability CVE-2026-54288 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54289 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-54289" }, "action_statement": "Vulnerability CVE-2026-54289 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54290 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-54290" }, "action_statement": "Vulnerability CVE-2026-54290 affects version 4.12.14 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-13T19:49:46.782400+00:00", "status_notes": "Vulnerability CVE-2026-56761 does not affect version 4.12.14 of hono. not_affected \u2014 Target hono 4.12.14 already contains the upstream fix (honojs/hono commit 66daa2ed, \"Merge commit from fork\"). JSX attribute names are validated by isValidAttributeName before being written to the output in both rendering paths. The fix shipped in the upstream 4.12.14 release, so this is an upstream fix and not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56761" }, "impact_statement": "not_affected \u2014 Target hono 4.12.14 already contains the upstream fix (honojs/hono commit 66daa2ed, \"Merge commit from fork\"). JSX attribute names are validated by isValidAttributeName before being written to the output in both rendering paths. The fix shipped in the upstream 4.12.14 release, so this is an upstream fix and not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-13T19:54:29.457147+00:00", "status_notes": "Vulnerability CVE-2026-56762 does not affect version 4.12.14 of hono. not_affected \u2014 Hono 4.12.14 already validates the cookie name on the write path. The upstream fix a586cd72 is an ancestor of HEAD and ships in the upstream 4.12.x release, before any TuxCare commit. serialize() and serializeSigned() both go through _serialize(), which rejects names that fail the RFC 6265 token regex, so CR/LF or other invalid characters cannot reach the Set-Cookie header.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56762" }, "impact_statement": "not_affected \u2014 Hono 4.12.14 already validates the cookie name on the write path. The upstream fix a586cd72 is an ancestor of HEAD and ships in the upstream 4.12.x release, before any TuxCare commit. serialize() and serializeSigned() both go through _serialize(), which rejects names that fail the RFC 6265 token regex, so CR/LF or other invalid characters cannot reach the Set-Cookie header." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-13T19:55:26.538286+00:00", "status_notes": "Vulnerability CVE-2026-56763 does not affect version 4.12.14 of hono. not_affected \u2014 Hono 4.12.14 already contains the upstream fix for CVE-2026-56763. The fix is commit ef902257 (author taku@taaas.jp, committed via GitHub). It adds a guard in handleParsingNestedValues in src/utils/body.ts that skips dot-notation keys containing a `__proto__.` segment. The commit is an ancestor of HEAD and part of the upstream 4.12.14 release, before the first TuxCare commit (87c979d8). It is t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56763" }, "impact_statement": "not_affected \u2014 Hono 4.12.14 already contains the upstream fix for CVE-2026-56763. The fix is commit ef902257 (author taku@taaas.jp, committed via GitHub). It adds a guard in handleParsingNestedValues in src/utils/body.ts that skips dot-notation keys containing a `__proto__.` segment. The commit is an ancestor of HEAD and part of the upstream 4.12.14 release, before the first TuxCare commit (87c979d8). It is t..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59895 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-59895" }, "action_statement": "Vulnerability CVE-2026-59895 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59896 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-59896" }, "action_statement": "Vulnerability CVE-2026-59896 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59897 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-59897" }, "action_statement": "Vulnerability CVE-2026-59897 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69207 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-69207" }, "action_statement": "Vulnerability CVE-2026-69207 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71848 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-71848" }, "action_statement": "Vulnerability CVE-2026-71848 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71849 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-71849" }, "action_statement": "Vulnerability CVE-2026-71849 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71850 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-71850" }, "action_statement": "Vulnerability CVE-2026-71850 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84363 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-84363" }, "action_statement": "Vulnerability CVE-2026-84363 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84364 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-84364" }, "action_statement": "Vulnerability CVE-2026-84364 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84365 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-84365" }, "action_statement": "Vulnerability CVE-2026-84365 affects version 4.12.14 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-09-30T23:54:00.098505+00:00", "status_notes": "Vulnerability CVE-2026-93981 affects version 4.12.14 of hono.", "vulnerability": { "name": "CVE-2026-93981" }, "action_statement": "Vulnerability CVE-2026-93981 affects version 4.12.14 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability GHSA-3wcj-gjvf-fvch is a false positive for hono 4.12.14.", "vulnerability": { "name": "GHSA-3wcj-gjvf-fvch" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability GHSA-55cm-p4ww-685g is a false positive for hono 4.12.14.", "vulnerability": { "name": "GHSA-55cm-p4ww-685g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-6623-4q32-82v8 is a false positive for hono 4.12.14.", "vulnerability": { "name": "GHSA-6623-4q32-82v8" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability GHSA-cw3j-28qq-x3xh is a false positive for hono 4.12.14.", "vulnerability": { "name": "GHSA-cw3j-28qq-x3xh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.14", "identifiers": { "purl": "pkg:npm/hono@4.12.14" } } ], "timestamp": "2026-11-13T19:51:24.435252+00:00", "status_notes": "Vulnerability GHSA-gq3j-xvxp-8hrf does not affect version 4.12.14 of hono. not_affected \u2014 Not affected. The upstream fix (honojs/hono 91def7ca) is already in the 4.12.14 release this target was built from. timingSafeEqual in src/utils/buffer.ts no longer compares hashes with ===. It uses a loop that XOR-accumulates over the full length of both strings.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-gq3j-xvxp-8hrf" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix (honojs/hono 91def7ca) is already in the 4.12.14 release this target was built from. timingSafeEqual in src/utils/buffer.ts no longer compares hashes with ===. It uses a loop that XOR-accumulates over the full length of both strings." } ] }