{ "@id": "urn:uuid:ed744edb-8c9d-40f0-9887-161b15c41b35", "role": "Document Creator", "author": "https://tuxcare.com", "version": 24, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T15:45:42.225833+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2023-50710 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2023-50710" }, "action_statement": "Vulnerability CVE-2023-50710 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-32869 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2024-32869" }, "action_statement": "Vulnerability CVE-2024-32869 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-43787 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2024-43787" }, "action_statement": "Vulnerability CVE-2024-43787 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-48913 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2024-48913" }, "action_statement": "Vulnerability CVE-2024-48913 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-58362 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2025-58362" }, "action_statement": "Vulnerability CVE-2025-58362 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-59139 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2025-59139" }, "action_statement": "Vulnerability CVE-2025-59139 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-62610 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2025-62610" }, "action_statement": "Vulnerability CVE-2025-62610 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-10-29T20:31:24.273560+00:00", "status_notes": "Vulnerability CVE-2025-71381 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2025-71381" }, "action_statement": "Vulnerability CVE-2025-71381 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-10-20T14:41:00.226982+00:00", "status_notes": "Vulnerability CVE-2026-111757 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2026-111757" }, "action_statement": "Vulnerability CVE-2026-111757 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-12T23:39:00.066400+00:00", "status_notes": "Vulnerability CVE-2026-126355 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2026-126355" }, "action_statement": "Vulnerability CVE-2026-126355 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-12T23:39:00.066400+00:00", "status_notes": "Vulnerability CVE-2026-126356 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2026-126356" }, "action_statement": "Vulnerability CVE-2026-126356 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126357 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2026-126357" }, "action_statement": "Vulnerability CVE-2026-126357 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126358 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2026-126358" }, "action_statement": "Vulnerability CVE-2026-126358 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126359 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2026-126359" }, "action_statement": "Vulnerability CVE-2026-126359 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-22817 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2026-22817" }, "action_statement": "Vulnerability CVE-2026-22817 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-22818 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2026-22818" }, "action_statement": "Vulnerability CVE-2026-22818 affects version 4.12.16 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-13T19:50:07.658643+00:00", "status_notes": "Vulnerability CVE-2026-24398 does not affect version 4.12.16 of hono. not_affected \u2014 The upstream fix for CVE-2026-24398 (hono commit edbf6eea) is already in this release (4.12.16). IPV4_REGEX in src/utils/ipaddr.ts now limits each octet to 0-255, so addresses like 1.2.2.355 are no longer classified as IPv4 and never reach convertIPv4ToBinary. The fix was authored upstream, not by TuxCare, and came in with the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24398" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-24398 (hono commit edbf6eea) is already in this release (4.12.16). IPV4_REGEX in src/utils/ipaddr.ts now limits each octet to 0-255, so addresses like 1.2.2.355 are no longer classified as IPv4 and never reach convertIPv4ToBinary. The fix was authored upstream, not by TuxCare, and came in with the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-13T19:47:35.365109+00:00", "status_notes": "Vulnerability CVE-2026-24472 does not affect version 4.12.16 of hono. not_affected \u2014 Hono 4.12.16 already contains the upstream fix for CVE-2026-24472. The cache middleware's shouldSkipCache() refuses to store responses whose Cache-Control contains private, no-store or no-cache. It also skips Vary: * and Set-Cookie. The fix is upstream commit 12c511745b3f1e7a3f863a23ce5f921c7fa805d1 by simon@koeck.dev, which is an ancestor of HEAD. HEAD has no commit from a TuxCare or CloudLinu...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24472" }, "impact_statement": "not_affected \u2014 Hono 4.12.16 already contains the upstream fix for CVE-2026-24472. The cache middleware's shouldSkipCache() refuses to store responses whose Cache-Control contains private, no-store or no-cache. It also skips Vary: * and Set-Cookie. The fix is upstream commit 12c511745b3f1e7a3f863a23ce5f921c7fa805d1 by simon@koeck.dev, which is an ancestor of HEAD. HEAD has no commit from a TuxCare or CloudLinu..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-13T19:51:00.041863+00:00", "status_notes": "Vulnerability CVE-2026-24473 does not affect version 4.12.16 of hono. not_affected \u2014 Target hono 4.12.16 already contains the upstream fix for CVE-2026-24473. getContentFromKVAsset in the Cloudflare Workers adapter no longer falls back to the raw request path as a KV key (`ASSET_MANIFEST[path] || path` is now `ASSET_MANIFEST[path]`). The fix commit cf9a78db is an upstream commit (author yusuke@kamawada.com, committer GitHub) and is part of the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24473" }, "impact_statement": "not_affected \u2014 Target hono 4.12.16 already contains the upstream fix for CVE-2026-24473. getContentFromKVAsset in the Cloudflare Workers adapter no longer falls back to the raw request path as a KV key (`ASSET_MANIFEST[path] || path` is now `ASSET_MANIFEST[path]`). The fix commit cf9a78db is an upstream commit (author yusuke@kamawada.com, committer GitHub) and is part of the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-13T19:49:00.036571+00:00", "status_notes": "Vulnerability CVE-2026-24771 does not affect version 4.12.16 of hono. not_affected \u2014 hono 4.12.16 already contains the upstream fix for CVE-2026-24771 (commit 2cf60046, \"Merge commit from fork\", author taku@taaas.jp). It shipped in the upstream release, before any TuxCare commit. ErrorBoundary in src/jsx/components.ts no longer forces its string children or fallback output to be treated as raw HTML. The final non-streaming return goes through Fragment, which escapes plain strings.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24771" }, "impact_statement": "not_affected \u2014 hono 4.12.16 already contains the upstream fix for CVE-2026-24771 (commit 2cf60046, \"Merge commit from fork\", author taku@taaas.jp). It shipped in the upstream release, before any TuxCare commit. ErrorBoundary in src/jsx/components.ts no longer forces its string children or fallback output to be treated as raw HTML. The final non-streaming return goes through Fragment, which escapes plain strings." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-27700 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2026-27700" }, "action_statement": "Vulnerability CVE-2026-27700 affects version 4.12.16 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-13T19:46:34.497162+00:00", "status_notes": "Vulnerability CVE-2026-29045 does not affect version 4.12.16 of hono. not_affected \u2014 hono 4.12.16 already contains the upstream fix for CVE-2026-29045. serveStatic decodes the request path with tryDecodeURI, which matches the router's decoding. It no longer uses decodeURIComponent, so %2F stays literal and /admin%2Fsecret.html no longer resolves to admin/secret.html. The fix commit 6a0607a9 was authored upstream and shipped in the release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29045" }, "impact_statement": "not_affected \u2014 hono 4.12.16 already contains the upstream fix for CVE-2026-29045. serveStatic decodes the request path with tryDecodeURI, which matches the router's decoding. It no longer uses decodeURIComponent, so %2F stays literal and /admin%2Fsecret.html no longer resolves to admin/secret.html. The fix commit 6a0607a9 was authored upstream and shipped in the release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-13T19:51:00.041863+00:00", "status_notes": "Vulnerability CVE-2026-29085 does not affect version 4.12.16 of hono. not_affected \u2014 Not affected. The upstream fix for CVE-2026-29085 (hono commit f4123ed9, author taku@taaas.jp) is already present in src/helper/streaming/sse.ts of hono 4.12.16. writeSSE() throws when event, id or retry contains CR or LF. The fix shipped in the upstream 4.12.16 release, before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29085" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2026-29085 (hono commit f4123ed9, author taku@taaas.jp) is already present in src/helper/streaming/sse.ts of hono 4.12.16. writeSSE() throws when event, id or retry contains CR or LF. The fix shipped in the upstream 4.12.16 release, before the first TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-13T19:49:46.782400+00:00", "status_notes": "Vulnerability CVE-2026-29086 does not affect version 4.12.16 of hono. not_affected \u2014 The target (hono 4.12.16) already contains the upstream fix for CVE-2026-29086. _serialize() in src/utils/cookie.ts rejects ';', '\\r' and '\\n' in the domain and path options before building the Set-Cookie string. The fix commit 44ae0c8c is upstream-authored (taku@taaas.jp, committer noreply@github.com) and is in the upstream release, so it is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29086" }, "impact_statement": "not_affected \u2014 The target (hono 4.12.16) already contains the upstream fix for CVE-2026-29086. _serialize() in src/utils/cookie.ts rejects ';', '\\r' and '\\n' in the domain and path options before building the Set-Cookie string. The fix commit 44ae0c8c is upstream-authored (taku@taaas.jp, committer noreply@github.com) and is in the upstream release, so it is not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-13T19:46:52.537695+00:00", "status_notes": "Vulnerability CVE-2026-39407 does not affect version 4.12.16 of hono. not_affected \u2014 The serveStatic repeated-slash fix from upstream commit 9aff14bd (CVE-2026-39407) is already in the target (hono 4.12.16). serveStatic rejects any decoded request path containing consecutive slashes or backslashes, so `//admin/secret.txt` falls through to next() and is never served. The fix is an upstream release fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39407" }, "impact_statement": "not_affected \u2014 The serveStatic repeated-slash fix from upstream commit 9aff14bd (CVE-2026-39407) is already in the target (hono 4.12.16). serveStatic rejects any decoded request path containing consecutive slashes or backslashes, so `//admin/secret.txt` falls through to next() and is never served. The fix is an upstream release fix, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-13T19:46:00.544804+00:00", "status_notes": "Vulnerability CVE-2026-39408 does not affect version 4.12.16 of hono. not_affected \u2014 Hono 4.12.16 already contains the upstream fix for CVE-2026-39408. generateFilePath() in src/helper/ssg/ssg.ts calls ensureWithinOutDir() on every computed output path, and the fix shipped in the upstream release, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39408" }, "impact_statement": "not_affected \u2014 Hono 4.12.16 already contains the upstream fix for CVE-2026-39408. generateFilePath() in src/helper/ssg/ssg.ts calls ensureWithinOutDir() on every computed output path, and the fix shipped in the upstream release, so the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-13T19:49:46.782400+00:00", "status_notes": "Vulnerability CVE-2026-39409 does not affect version 4.12.16 of hono. not_affected \u2014 The target (hono 4.12.16) already contains the upstream fix for CVE-2026-39409. The fix commit 48fa2233 is an ancestor of HEAD and shipped in the upstream release. ipRestriction() canonicalizes IPv4-mapped IPv6 client addresses to IPv4 before matching static and CIDR rules.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39409" }, "impact_statement": "not_affected \u2014 The target (hono 4.12.16) already contains the upstream fix for CVE-2026-39409. The fix commit 48fa2233 is an ancestor of HEAD and shipped in the upstream release. ipRestriction() canonicalizes IPv4-mapped IPv6 client addresses to IPv4 before matching static and CIDR rules." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-13T19:52:00.137305+00:00", "status_notes": "Vulnerability CVE-2026-39410 does not affect version 4.12.16 of hono. not_affected \u2014 Not affected. The upstream fix (commit cc067c85, author taku@taaas.jp) is already in hono 4.12.16. parse() in src/utils/cookie.ts now trims names and values with trimCookieWhitespace, which strips only SP and HTAB. U+00A0-prefixed cookie names are no longer collapsed onto the legitimate name. The fix was in the upstream release before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39410" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix (commit cc067c85, author taku@taaas.jp) is already in hono 4.12.16. parse() in src/utils/cookie.ts now trims names and values with trimCookieWhitespace, which strips only SP and HTAB. U+00A0-prefixed cookie names are no longer collapsed onto the legitimate name. The fix was in the upstream release before the first TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-13T19:48:00.051925+00:00", "status_notes": "Vulnerability CVE-2026-44455 does not affect version 4.12.16 of hono. not_affected \u2014 hono 4.12.16 already contains the upstream fix for CVE-2026-44455. The JSXNode constructor in src/jsx/base.ts rejects unsafe tag names through isValidTagName from src/jsx/utils.ts. The fix is upstream commit 614b8345 (author taku@taaas.jp). That commit is an ancestor of HEAD and shipped in the 4.12.16 release. No TuxCare-domain commit exists in HEAD's history.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44455" }, "impact_statement": "not_affected \u2014 hono 4.12.16 already contains the upstream fix for CVE-2026-44455. The JSXNode constructor in src/jsx/base.ts rejects unsafe tag names through isValidTagName from src/jsx/utils.ts. The fix is upstream commit 614b8345 (author taku@taaas.jp). That commit is an ancestor of HEAD and shipped in the 4.12.16 release. No TuxCare-domain commit exists in HEAD's history." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-13T19:48:18.808255+00:00", "status_notes": "Vulnerability CVE-2026-44456 does not affect version 4.12.16 of hono. not_affected \u2014 The target (hono 4.12.16) already contains the upstream fix for CVE-2026-44456. For chunked or unknown-length bodies, bodyLimit() now reads the whole body and decides on its size before calling next(). The fix commit db05b96d is upstream-authored and ships in the 4.12.16 release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44456" }, "impact_statement": "not_affected \u2014 The target (hono 4.12.16) already contains the upstream fix for CVE-2026-44456. For chunked or unknown-length bodies, bodyLimit() now reads the whole body and decides on its size before calling next(). The fix commit db05b96d is upstream-authored and ships in the 4.12.16 release." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-14T15:45:42.225833+00:00", "status_notes": "Vulnerability CVE-2026-44457 affects version 4.12.16 of hono, and is fixed in 4.12.16-tuxcare.1.", "vulnerability": { "name": "CVE-2026-44457" }, "action_statement": "Vulnerability CVE-2026-44457 affects version 4.12.16 of hono, and is fixed in 4.12.16-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-14T15:45:42.225833+00:00", "status_notes": "Vulnerability CVE-2026-44458 affects version 4.12.16 of hono, and is fixed in 4.12.16-tuxcare.1.", "vulnerability": { "name": "CVE-2026-44458" }, "action_statement": "Vulnerability CVE-2026-44458 affects version 4.12.16 of hono, and is fixed in 4.12.16-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-14T15:45:42.225833+00:00", "status_notes": "Vulnerability CVE-2026-44459 affects version 4.12.16 of hono, and is fixed in 4.12.16-tuxcare.1.", "vulnerability": { "name": "CVE-2026-44459" }, "action_statement": "Vulnerability CVE-2026-44459 affects version 4.12.16 of hono, and is fixed in 4.12.16-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-14T15:45:42.225833+00:00", "status_notes": "Vulnerability CVE-2026-47673 affects version 4.12.16 of hono, and is fixed in 4.12.16-tuxcare.1.", "vulnerability": { "name": "CVE-2026-47673" }, "action_statement": "Vulnerability CVE-2026-47673 affects version 4.12.16 of hono, and is fixed in 4.12.16-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-14T15:45:42.225833+00:00", "status_notes": "Vulnerability CVE-2026-47674 affects version 4.12.16 of hono, and is fixed in 4.12.16-tuxcare.1.", "vulnerability": { "name": "CVE-2026-47674" }, "action_statement": "Vulnerability CVE-2026-47674 affects version 4.12.16 of hono, and is fixed in 4.12.16-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-14T15:45:42.225833+00:00", "status_notes": "Vulnerability CVE-2026-47675 affects version 4.12.16 of hono, and is fixed in 4.12.16-tuxcare.1.", "vulnerability": { "name": "CVE-2026-47675" }, "action_statement": "Vulnerability CVE-2026-47675 affects version 4.12.16 of hono, and is fixed in 4.12.16-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47676 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2026-47676" }, "action_statement": "Vulnerability CVE-2026-47676 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-14T15:45:42.225833+00:00", "status_notes": "Vulnerability CVE-2026-54286 affects version 4.12.16 of hono, and is fixed in 4.12.16-tuxcare.1.", "vulnerability": { "name": "CVE-2026-54286" }, "action_statement": "Vulnerability CVE-2026-54286 affects version 4.12.16 of hono, and is fixed in 4.12.16-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-14T15:45:42.225833+00:00", "status_notes": "Vulnerability CVE-2026-54287 affects version 4.12.16 of hono, and is fixed in 4.12.16-tuxcare.1.", "vulnerability": { "name": "CVE-2026-54287" }, "action_statement": "Vulnerability CVE-2026-54287 affects version 4.12.16 of hono, and is fixed in 4.12.16-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-14T15:45:42.225833+00:00", "status_notes": "Vulnerability CVE-2026-54288 affects version 4.12.16 of hono, and is fixed in 4.12.16-tuxcare.1.", "vulnerability": { "name": "CVE-2026-54288" }, "action_statement": "Vulnerability CVE-2026-54288 affects version 4.12.16 of hono, and is fixed in 4.12.16-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54289 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2026-54289" }, "action_statement": "Vulnerability CVE-2026-54289 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-14T15:45:42.225833+00:00", "status_notes": "Vulnerability CVE-2026-54290 affects version 4.12.16 of hono, and is fixed in 4.12.16-tuxcare.1.", "vulnerability": { "name": "CVE-2026-54290" }, "action_statement": "Vulnerability CVE-2026-54290 affects version 4.12.16 of hono, and is fixed in 4.12.16-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-13T19:49:46.782400+00:00", "status_notes": "Vulnerability CVE-2026-56761 does not affect version 4.12.16 of hono. not_affected \u2014 Not affected. hono 4.12.16 already contains the upstream fix for CVE-2026-56761. JSX attribute names are validated by isValidAttributeName before they are written to the output, in both the intrinsic-element serializer and jsxAttr. The fix commit 66daa2ed (author taku@taaas.jp, committer noreply@github.com) is an ancestor of the upstream 4.12.16 release commit 90d4182a. HEAD has no TuxCare-doma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56761" }, "impact_statement": "not_affected \u2014 Not affected. hono 4.12.16 already contains the upstream fix for CVE-2026-56761. JSX attribute names are validated by isValidAttributeName before they are written to the output, in both the intrinsic-element serializer and jsxAttr. The fix commit 66daa2ed (author taku@taaas.jp, committer noreply@github.com) is an ancestor of the upstream 4.12.16 release commit 90d4182a. HEAD has no TuxCare-doma..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-13T19:54:29.457147+00:00", "status_notes": "Vulnerability CVE-2026-56762 does not affect version 4.12.16 of hono. not_affected \u2014 Target hono 4.12.16 already contains the upstream fix (commit a586cd72, authored by Yusuke Wada). _serialize() in src/utils/cookie.ts now throws 'Invalid cookie name' when the name does not match the RFC 6265 token regex. setCookie, serialize and serializeSigned all go through _serialize(). The fix shipped in the upstream release, so the target is not affected. Note: the CVE itself says no expl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56762" }, "impact_statement": "not_affected \u2014 Target hono 4.12.16 already contains the upstream fix (commit a586cd72, authored by Yusuke Wada). _serialize() in src/utils/cookie.ts now throws 'Invalid cookie name' when the name does not match the RFC 6265 token regex. setCookie, serialize and serializeSigned all go through _serialize(). The fix shipped in the upstream release, so the target is not affected. Note: the CVE itself says no expl..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-13T19:55:00.037891+00:00", "status_notes": "Vulnerability CVE-2026-56763 does not affect version 4.12.16 of hono. not_affected \u2014 The upstream fix ef902257 (\"Merge commit from fork\", author taku@taaas.jp) is already in HEAD. handleParsingNestedValues in src/utils/body.ts now rejects any dotted key containing a `__proto__` path segment, so parseBody({dot:true}) can no longer build objects with a `__proto__` property from such keys. The fix is an upstream commit, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56763" }, "impact_statement": "not_affected \u2014 The upstream fix ef902257 (\"Merge commit from fork\", author taku@taaas.jp) is already in HEAD. handleParsingNestedValues in src/utils/body.ts now rejects any dotted key containing a `__proto__` path segment, so parseBody({dot:true}) can no longer build objects with a `__proto__` property from such keys. The fix is an upstream commit, not a TuxCare backport." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59895 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2026-59895" }, "action_statement": "Vulnerability CVE-2026-59895 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59896 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2026-59896" }, "action_statement": "Vulnerability CVE-2026-59896 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59897 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2026-59897" }, "action_statement": "Vulnerability CVE-2026-59897 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69207 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2026-69207" }, "action_statement": "Vulnerability CVE-2026-69207 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71848 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2026-71848" }, "action_statement": "Vulnerability CVE-2026-71848 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71849 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2026-71849" }, "action_statement": "Vulnerability CVE-2026-71849 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71850 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2026-71850" }, "action_statement": "Vulnerability CVE-2026-71850 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84363 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2026-84363" }, "action_statement": "Vulnerability CVE-2026-84363 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84364 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2026-84364" }, "action_statement": "Vulnerability CVE-2026-84364 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84365 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2026-84365" }, "action_statement": "Vulnerability CVE-2026-84365 affects version 4.12.16 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-09-30T23:54:00.098505+00:00", "status_notes": "Vulnerability CVE-2026-93981 affects version 4.12.16 of hono.", "vulnerability": { "name": "CVE-2026-93981" }, "action_statement": "Vulnerability CVE-2026-93981 affects version 4.12.16 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability GHSA-3wcj-gjvf-fvch is a false positive for hono 4.12.16.", "vulnerability": { "name": "GHSA-3wcj-gjvf-fvch" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability GHSA-55cm-p4ww-685g is a false positive for hono 4.12.16.", "vulnerability": { "name": "GHSA-55cm-p4ww-685g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-6623-4q32-82v8 is a false positive for hono 4.12.16.", "vulnerability": { "name": "GHSA-6623-4q32-82v8" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability GHSA-cw3j-28qq-x3xh is a false positive for hono 4.12.16.", "vulnerability": { "name": "GHSA-cw3j-28qq-x3xh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.16", "identifiers": { "purl": "pkg:npm/hono@4.12.16" } } ], "timestamp": "2026-11-13T19:51:24.435252+00:00", "status_notes": "Vulnerability GHSA-gq3j-xvxp-8hrf does not affect version 4.12.16 of hono. not_affected \u2014 The target (hono 4.12.16) already contains the upstream fix for GHSA-gq3j-xvxp-8hrf. In src/utils/buffer.ts, timingSafeEqualString compares the hashes (and the originals) with constantTimeEqualString, an XOR/OR loop that covers the full max length and does not return early. The fix commit 91def7ca is upstream work by yusuke@kamawada.com (committer noreply@github.com). It is an ancestor of the 4...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-gq3j-xvxp-8hrf" }, "impact_statement": "not_affected \u2014 The target (hono 4.12.16) already contains the upstream fix for GHSA-gq3j-xvxp-8hrf. In src/utils/buffer.ts, timingSafeEqualString compares the hashes (and the originals) with constantTimeEqualString, an XOR/OR loop that covers the full max length and does not return early. The fix commit 91def7ca is upstream work by yusuke@kamawada.com (committer noreply@github.com). It is an ancestor of the 4..." } ] }