{ "@id": "urn:uuid:6a7f0185-612d-4038-8f89-92560643271a", "role": "Document Creator", "author": "https://tuxcare.com", "version": 34, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T19:55:00.037891+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2023-50710 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2023-50710" }, "action_statement": "Vulnerability CVE-2023-50710 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-32869 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2024-32869" }, "action_statement": "Vulnerability CVE-2024-32869 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-43787 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2024-43787" }, "action_statement": "Vulnerability CVE-2024-43787 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-48913 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2024-48913" }, "action_statement": "Vulnerability CVE-2024-48913 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-58362 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2025-58362" }, "action_statement": "Vulnerability CVE-2025-58362 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-59139 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2025-59139" }, "action_statement": "Vulnerability CVE-2025-59139 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-62610 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2025-62610" }, "action_statement": "Vulnerability CVE-2025-62610 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-10-29T20:31:24.273560+00:00", "status_notes": "Vulnerability CVE-2025-71381 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2025-71381" }, "action_statement": "Vulnerability CVE-2025-71381 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-10-20T14:42:09.335337+00:00", "status_notes": "Vulnerability CVE-2026-111757 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2026-111757" }, "action_statement": "Vulnerability CVE-2026-111757 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-12T23:39:00.066400+00:00", "status_notes": "Vulnerability CVE-2026-126355 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2026-126355" }, "action_statement": "Vulnerability CVE-2026-126355 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-12T23:39:00.066400+00:00", "status_notes": "Vulnerability CVE-2026-126356 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2026-126356" }, "action_statement": "Vulnerability CVE-2026-126356 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126357 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2026-126357" }, "action_statement": "Vulnerability CVE-2026-126357 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126358 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2026-126358" }, "action_statement": "Vulnerability CVE-2026-126358 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126359 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2026-126359" }, "action_statement": "Vulnerability CVE-2026-126359 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-22817 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2026-22817" }, "action_statement": "Vulnerability CVE-2026-22817 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-22818 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2026-22818" }, "action_statement": "Vulnerability CVE-2026-22818 affects version 4.12.25 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:50:12.018005+00:00", "status_notes": "Vulnerability CVE-2026-24398 does not affect version 4.12.25 of hono. not_affected \u2014 Hono 4.12.25 already contains the upstream fix (edbf6eea, \"Merge commit from fork\", author yusuke@kamawada.com) for CVE-2026-24398. IPV4_REGEX now restricts each octet to 0-255, and convertIPv4ToBinary uses a strict parser that throws on any octet above 255. The fix is in the upstream release, which predates the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24398" }, "impact_statement": "not_affected \u2014 Hono 4.12.25 already contains the upstream fix (edbf6eea, \"Merge commit from fork\", author yusuke@kamawada.com) for CVE-2026-24398. IPV4_REGEX now restricts each octet to 0-255, and convertIPv4ToBinary uses a strict parser that throws on any octet above 255. The fix is in the upstream release, which predates the first TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:47:35.365109+00:00", "status_notes": "Vulnerability CVE-2026-24472 does not affect version 4.12.25 of hono. not_affected \u2014 The target (hono 4.12.25) already contains the upstream fix for CVE-2026-24472. src/middleware/cache/index.ts skips caching when Cache-Control contains private, no-store or no-cache, and also when Set-Cookie is present. The fix is upstream commit 12c511745b3f1e7a3f863a23ce5f921c7fa805d1 by simon@koeck.dev, committed via noreply@github.com. It is an ancestor of HEAD and shipped in the upstream r...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24472" }, "impact_statement": "not_affected \u2014 The target (hono 4.12.25) already contains the upstream fix for CVE-2026-24472. src/middleware/cache/index.ts skips caching when Cache-Control contains private, no-store or no-cache, and also when Set-Cookie is present. The fix is upstream commit 12c511745b3f1e7a3f863a23ce5f921c7fa805d1 by simon@koeck.dev, committed via noreply@github.com. It is an ancestor of HEAD and shipped in the upstream r..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:51:00.041863+00:00", "status_notes": "Vulnerability CVE-2026-24473 does not affect version 4.12.25 of hono. not_affected \u2014 The vulnerable fallback `ASSET_MANIFEST[path] || path` is not present in the target. The upstream fix (cf9a78db) is an ancestor of HEAD and ships in the upstream 4.12.25 release, so an unmapped request path can no longer be used as a raw KV key. The target has no TuxCare-domain commits, so this is an upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24473" }, "impact_statement": "not_affected \u2014 The vulnerable fallback `ASSET_MANIFEST[path] || path` is not present in the target. The upstream fix (cf9a78db) is an ancestor of HEAD and ships in the upstream 4.12.25 release, so an unmapped request path can no longer be used as a raw KV key. The target has no TuxCare-domain commits, so this is an upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:49:00.036571+00:00", "status_notes": "Vulnerability CVE-2026-24771 does not affect version 4.12.25 of hono. not_affected \u2014 Hono 4.12.25 already contains the upstream fix for CVE-2026-24771 (commit 2cf60046, \"Merge commit from fork\"). ErrorBoundary in src/jsx/components.ts no longer forces children or fallback output to raw HTML. The fix shipped in the upstream release and is not TuxCare-authored, so the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24771" }, "impact_statement": "not_affected \u2014 Hono 4.12.25 already contains the upstream fix for CVE-2026-24771 (commit 2cf60046, \"Merge commit from fork\"). ErrorBoundary in src/jsx/components.ts no longer forces children or fallback output to raw HTML. The fix shipped in the upstream release and is not TuxCare-authored, so the verdict is not_affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-27700 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2026-27700" }, "action_statement": "Vulnerability CVE-2026-27700 affects version 4.12.25 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:46:22.607017+00:00", "status_notes": "Vulnerability CVE-2026-29045 does not affect version 4.12.25 of hono. not_affected \u2014 Hono 4.12.25 already contains the upstream fix for CVE-2026-29045. serveStatic decodes the request path with tryDecodeURI, the same decoding semantics the router uses, instead of decodeURIComponent. Encoded slashes (%2F) therefore stay literal and can't bypass route-based middleware. The fix commit 6a0607a929d8 is upstream-authored and is an ancestor of HEAD. HEAD has no TuxCare-authored commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29045" }, "impact_statement": "not_affected \u2014 Hono 4.12.25 already contains the upstream fix for CVE-2026-29045. serveStatic decodes the request path with tryDecodeURI, the same decoding semantics the router uses, instead of decodeURIComponent. Encoded slashes (%2F) therefore stay literal and can't bypass route-based middleware. The fix commit 6a0607a929d8 is upstream-authored and is an ancestor of HEAD. HEAD has no TuxCare-authored commits." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:51:00.041863+00:00", "status_notes": "Vulnerability CVE-2026-29085 does not affect version 4.12.25 of hono. not_affected \u2014 The upstream fix for CVE-2026-29085 is already in the target (hono 4.12.25). SSEStreamingApi.writeSSE in src/helper/streaming/sse.ts throws if event, id or retry contains CR or LF. The fix commit f4123ed9 was authored upstream by taku@taaas.jp and shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29085" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-29085 is already in the target (hono 4.12.25). SSEStreamingApi.writeSSE in src/helper/streaming/sse.ts throws if event, id or retry contains CR or LF. The fix commit f4123ed9 was authored upstream by taku@taaas.jp and shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:50:04.403996+00:00", "status_notes": "Vulnerability CVE-2026-29086 does not affect version 4.12.25 of hono. not_affected \u2014 The fix for CVE-2026-29086 is already in this target (hono 4.12.25). _serialize() in src/utils/cookie.ts rejects ';', '\\r' and '\\n' in domain and path (and also sameSite and priority) before building the Set-Cookie header. The fix is upstream commit 44ae0c8c, which is an ancestor of the upstream 4.12.25 release commit fce483e1. It is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29086" }, "impact_statement": "not_affected \u2014 The fix for CVE-2026-29086 is already in this target (hono 4.12.25). _serialize() in src/utils/cookie.ts rejects ';', '\\r' and '\\n' in domain and path (and also sameSite and priority) before building the Set-Cookie header. The fix is upstream commit 44ae0c8c, which is an ancestor of the upstream 4.12.25 release commit fce483e1. It is not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:46:52.537695+00:00", "status_notes": "Vulnerability CVE-2026-39407 does not affect version 4.12.25 of hono. not_affected \u2014 Not affected. The target (hono 4.12.25) already contains the upstream fix for CVE-2026-39407, commit 9aff14bd (Taku Amano, taku@taaas.jp). serveStatic rejects any request path with consecutive slashes or backslashes. The commit was in the upstream 4.12.25 release and is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39407" }, "impact_statement": "not_affected \u2014 Not affected. The target (hono 4.12.25) already contains the upstream fix for CVE-2026-39407, commit 9aff14bd (Taku Amano, taku@taaas.jp). serveStatic rejects any request path with consecutive slashes or backslashes. The commit was in the upstream 4.12.25 release and is not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:45:57.825172+00:00", "status_notes": "Vulnerability CVE-2026-39408 does not affect version 4.12.25 of hono. not_affected \u2014 The upstream fix for CVE-2026-39408 (hono commit b470278, \"Merge commit from fork\") is already in the target (hono 4.12.25). generateFilePath() now calls ensureWithinOutDir(), which throws \"Path traversal detected\" if the resolved output path is outside outDir. The fix shipped in the upstream 4.12.25 release and was authored by upstream (yusuke@kamawada.com), not TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39408" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-39408 (hono commit b470278, \"Merge commit from fork\") is already in the target (hono 4.12.25). generateFilePath() now calls ensureWithinOutDir(), which throws \"Path traversal detected\" if the resolved output path is outside outDir. The fix shipped in the upstream 4.12.25 release and was authored by upstream (yusuke@kamawada.com), not TuxCare." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:49:00.036571+00:00", "status_notes": "Vulnerability CVE-2026-39409 does not affect version 4.12.25 of hono. not_affected \u2014 The target (hono 4.12.25) already contains the upstream fix for CVE-2026-39409. ipRestriction canonicalizes IPv4-mapped IPv6 client addresses so IPv4 static and CIDR rules match them. The fix is upstream commit 48fa2233 (author yusuke@kamawada.com). It is an ancestor of HEAD and predates the first TuxCare commit (19b76649), so it shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39409" }, "impact_statement": "not_affected \u2014 The target (hono 4.12.25) already contains the upstream fix for CVE-2026-39409. ipRestriction canonicalizes IPv4-mapped IPv6 client addresses so IPv4 static and CIDR rules match them. The fix is upstream commit 48fa2233 (author yusuke@kamawada.com). It is an ancestor of HEAD and predates the first TuxCare commit (19b76649), so it shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:52:13.528805+00:00", "status_notes": "Vulnerability CVE-2026-39410 does not affect version 4.12.25 of hono. not_affected \u2014 Not affected. The upstream fix (cc067c85, Taku Amano, merged via GitHub) is already in the hono 4.12.25 release. cookie.ts parse() trims cookie names and values with trimCookieWhitespace, which strips only SP (0x20) and HTAB (0x09), not U+00A0. A name like \"\u00a0dummy-cookie\" stays distinct and fails the cookie-name regex.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39410" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix (cc067c85, Taku Amano, merged via GitHub) is already in the hono 4.12.25 release. cookie.ts parse() trims cookie names and values with trimCookieWhitespace, which strips only SP (0x20) and HTAB (0x09), not U+00A0. A name like \"\u00a0dummy-cookie\" stays distinct and fails the cookie-name regex." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:48:00.051925+00:00", "status_notes": "Vulnerability CVE-2026-44455 does not affect version 4.12.25 of hono. not_affected \u2014 The target (hono 4.12.25) already contains the upstream fix for CVE-2026-44455. JSXNode's constructor validates string tag names with isValidTagName and throws on invalid names. The fix is upstream commit 614b8345, authored by Taku Amano, and it was already part of the upstream 4.12.25 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44455" }, "impact_statement": "not_affected \u2014 The target (hono 4.12.25) already contains the upstream fix for CVE-2026-44455. JSXNode's constructor validates string tag names with isValidTagName and throws on invalid names. The fix is upstream commit 614b8345, authored by Taku Amano, and it was already part of the upstream 4.12.25 release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:48:18.808255+00:00", "status_notes": "Vulnerability CVE-2026-44456 does not affect version 4.12.25 of hono. not_affected \u2014 Target (hono 4.12.25) already contains the upstream fix db05b96d for CVE-2026-44456. bodyLimit() now reads chunked or unknown-length bodies up front and rejects once the size exceeds maxSize, before next() runs. The fix was shipped in the upstream 4.12.25 release and is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44456" }, "impact_statement": "not_affected \u2014 Target (hono 4.12.25) already contains the upstream fix db05b96d for CVE-2026-44456. bodyLimit() now reads chunked or unknown-length bodies up front and rejects once the size exceeds maxSize, before next() runs. The fix was shipped in the upstream 4.12.25 release and is not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:44:00.117801+00:00", "status_notes": "Vulnerability CVE-2026-44457 does not affect version 4.12.25 of hono. not_affected \u2014 Hono 4.12.25 already contains the upstream fix (568c2ecc, \"Merge commit from fork\"), which shipped in the upstream release before any TuxCare commit. Cache middleware skips any response with a Vary header not covered by the configured vary option. It also bypasses caching entirely for non-GET requests and requests carrying Authorization. Responses with Vary: Authorization or Vary: Cookie are no...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44457" }, "impact_statement": "not_affected \u2014 Hono 4.12.25 already contains the upstream fix (568c2ecc, \"Merge commit from fork\"), which shipped in the upstream release before any TuxCare commit. Cache middleware skips any response with a Vary header not covered by the configured vary option. It also bypasses caching entirely for non-GET requests and requests carrying Authorization. Responses with Vary: Authorization or Vary: Cookie are no..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:43:16.611537+00:00", "status_notes": "Vulnerability CVE-2026-44458 does not affect version 4.12.25 of hono. not_affected \u2014 Hono 4.12.25 already contains the upstream fix for CVE-2026-44458. Style object property names and values are validated for CSS declaration-boundary characters before the style string is built. The fix commit 58d3d3ad is upstream-authored and is an ancestor of HEAD. HEAD has no TuxCare-domain commits, so it is a plain upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44458" }, "impact_statement": "not_affected \u2014 Hono 4.12.25 already contains the upstream fix for CVE-2026-44458. Style object property names and values are validated for CSS declaration-boundary characters before the style string is built. The fix commit 58d3d3ad is upstream-authored and is an ancestor of HEAD. HEAD has no TuxCare-domain commits, so it is a plain upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:39:32.180152+00:00", "status_notes": "Vulnerability CVE-2026-44459 does not affect version 4.12.25 of hono. not_affected \u2014 Upstream fix a5bd9ebe (hono, \"Merge commit from fork\") is already in HEAD (4.12.25). verify() in src/utils/jwt/jwt.ts rejects exp/nbf/iat values that are non-numeric or non-finite, and checks presence with `!== undefined` instead of truthiness.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44459" }, "impact_statement": "not_affected \u2014 Upstream fix a5bd9ebe (hono, \"Merge commit from fork\") is already in HEAD (4.12.25). verify() in src/utils/jwt/jwt.ts rejects exp/nbf/iat values that are non-numeric or non-finite, and checks presence with `!== undefined` instead of truthiness." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:41:00.162773+00:00", "status_notes": "Vulnerability CVE-2026-47673 does not affect version 4.12.25 of hono. not_affected \u2014 Target (hono 4.12.25, 12d03414) already contains the upstream fix. Both jwt and jwk middleware reject any Authorization/custom header whose first token is not 'bearer' (case-insensitive) with 401 invalid_request. The fix commit 5463db27 (author taku@taaas.jp) is an ancestor of HEAD and ships in the upstream history; HEAD has no TuxCare-authored commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47673" }, "impact_statement": "not_affected \u2014 Target (hono 4.12.25, 12d03414) already contains the upstream fix. Both jwt and jwk middleware reject any Authorization/custom header whose first token is not 'bearer' (case-insensitive) with 401 invalid_request. The fix commit 5463db27 (author taku@taaas.jp) is an ancestor of HEAD and ships in the upstream history; HEAD has no TuxCare-authored commits." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:41:53.414094+00:00", "status_notes": "Vulnerability CVE-2026-47674 does not affect version 4.12.25 of hono. not_affected \u2014 Target hono 4.12.25 already contains the upstream fix for CVE-2026-47674: commit c831020fb1fa (\"fix(ip-restriction): match static IP rules numerically\" plus ipaddr validation). The commit is an ancestor of the 4.12.25 release commit, so the fix shipped in the upstream release. Its author is taku@taaas.jp, not a TuxCare identity.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47674" }, "impact_statement": "not_affected \u2014 Target hono 4.12.25 already contains the upstream fix for CVE-2026-47674: commit c831020fb1fa (\"fix(ip-restriction): match static IP rules numerically\" plus ipaddr validation). The commit is an ancestor of the 4.12.25 release commit, so the fix shipped in the upstream release. Its author is taku@taaas.jp, not a TuxCare identity." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:39:54.275085+00:00", "status_notes": "Vulnerability CVE-2026-47675 does not affect version 4.12.25 of hono. not_affected \u2014 The target (hono 4.13.18 base) already contains the upstream fix for CVE-2026-47675. src/utils/cookie.ts:194-198 applies the /[;\\r\\n]/ check to sameSite and priority as well as domain and path, and throws on a match. The fix is upstream commit 905aedbc, authored by taku@taaas.jp. It shipped in the upstream release before the first TuxCare commit, so no TuxCare attribution applies.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47675" }, "impact_statement": "not_affected \u2014 The target (hono 4.13.18 base) already contains the upstream fix for CVE-2026-47675. src/utils/cookie.ts:194-198 applies the /[;\\r\\n]/ check to sameSite and priority as well as domain and path, and throws on a match. The fix is upstream commit 905aedbc, authored by taku@taaas.jp. It shipped in the upstream release before the first TuxCare commit, so no TuxCare attribution applies." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:45:19.330855+00:00", "status_notes": "Vulnerability CVE-2026-47676 does not affect version 4.12.25 of hono. not_affected \u2014 Hono 4.12.25 already contains the upstream fix (commit 6cbb025f, authored by Taku Amano, taku@taaas.jp). app.mount() now slices the decoded path returned by this.getPath(request), the same representation the router matches against, so the prefix offset is consistent. The vulnerable pre-fix code (url.pathname.slice(pathPrefixLength) on the raw pathname) is absent from HEAD.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47676" }, "impact_statement": "not_affected \u2014 Hono 4.12.25 already contains the upstream fix (commit 6cbb025f, authored by Taku Amano, taku@taaas.jp). app.mount() now slices the decoded path returned by this.getPath(request), the same representation the router matches against, so the prefix offset is consistent. The vulnerable pre-fix code (url.pathname.slice(pathPrefixLength) on the raw pathname) is absent from HEAD." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:41:00.162773+00:00", "status_notes": "Vulnerability CVE-2026-54286 does not affect version 4.12.25 of hono. not_affected \u2014 Hono 4.12.25 already contains the upstream fix for CVE-2026-54286. serve-static rejects any decoded path containing a backslash before the path reaches the file resolver. The fix commit is upstream-authored and shipped in the 4.12.25 release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54286" }, "impact_statement": "not_affected \u2014 Hono 4.12.25 already contains the upstream fix for CVE-2026-54286. serve-static rejects any decoded path containing a backslash before the path reaches the file resolver. The fix commit is upstream-authored and shipped in the 4.12.25 release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:44:19.577635+00:00", "status_notes": "Vulnerability CVE-2026-54287 does not affect version 4.12.25 of hono. not_affected \u2014 The upstream fix for CVE-2026-54287 (hono commit 7ae7cbae) is already in HEAD, shipped with the upstream 4.12.25 release. ALBProcessor and LatticeV2Processor no longer comma-join Set-Cookie values. No TuxCare-authored commit carries the fix, so this is not_affected rather than already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54287" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-54287 (hono commit 7ae7cbae) is already in HEAD, shipped with the upstream 4.12.25 release. ALBProcessor and LatticeV2Processor no longer comma-join Set-Cookie values. No TuxCare-authored commit carries the fix, so this is not_affected rather than already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:41:53.414094+00:00", "status_notes": "Vulnerability CVE-2026-54288 does not affect version 4.12.25 of hono. not_affected \u2014 Target hono 4.12.25 already contains the upstream fix (fa5f9bfc, authored by Yusuke Wada). The AWS Lambda and Lambda@Edge adapters now overwrite the client-supplied Content-Length with the actual decoded body byte length, so bodyLimit's Content-Length trust is sound. The patch is upstream-authored and shipped in the upstream 4.12.25 release; there is no TuxCare-authored fix commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54288" }, "impact_statement": "not_affected \u2014 Target hono 4.12.25 already contains the upstream fix (fa5f9bfc, authored by Yusuke Wada). The AWS Lambda and Lambda@Edge adapters now overwrite the client-supplied Content-Length with the actual decoded body byte length, so bodyLimit's Content-Length trust is sound. The patch is upstream-authored and shipped in the upstream 4.12.25 release; there is no TuxCare-authored fix commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:45:36.334046+00:00", "status_notes": "Vulnerability CVE-2026-54289 does not affect version 4.12.25 of hono. not_affected \u2014 Not affected. The Lambda@Edge adapter in hono 4.12.25 already uses Headers.append for each repeated header value. The upstream fix (3892a6c2, by Yusuke Wada) shipped in the 4.12.25 release that this branch is based on.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54289" }, "impact_statement": "not_affected \u2014 Not affected. The Lambda@Edge adapter in hono 4.12.25 already uses Headers.append for each repeated header value. The upstream fix (3892a6c2, by Yusuke Wada) shipped in the 4.12.25 release that this branch is based on." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:44:14.338410+00:00", "status_notes": "Vulnerability CVE-2026-54290 does not affect version 4.12.25 of hono. not_affected \u2014 The upstream fix (f0b094db) is already in the target. src/middleware/cors/index.ts no longer reflects the request Origin when origin is '*' and credentials is true. Upstream shipped it in 4.12.25, and there is no TuxCare-attributed commit for it.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54290" }, "impact_statement": "not_affected \u2014 The upstream fix (f0b094db) is already in the target. src/middleware/cors/index.ts no longer reflects the request Origin when origin is '*' and credentials is true. Upstream shipped it in 4.12.25, and there is no TuxCare-attributed commit for it." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:49:46.782400+00:00", "status_notes": "Vulnerability CVE-2026-56761 does not affect version 4.12.25 of hono. not_affected \u2014 The target (hono 4.12.25) already contains the upstream fix (commit 66daa2ed, \"validate attribute names to prevent XSS via key injection\"). It shipped in the upstream 4.12.25 release, so the vulnerable pattern is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56761" }, "impact_statement": "not_affected \u2014 The target (hono 4.12.25) already contains the upstream fix (commit 66daa2ed, \"validate attribute names to prevent XSS via key injection\"). It shipped in the upstream 4.12.25 release, so the vulnerable pattern is absent." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:54:29.457147+00:00", "status_notes": "Vulnerability CVE-2026-56762 does not affect version 4.12.25 of hono. not_affected \u2014 The target already contains the upstream fix. _serialize() in src/utils/cookie.ts rejects cookie names that do not match the RFC 6265 token regex, and serialize(), serializeSigned() and setCookie() all go through it. The fix is upstream commit a586cd72 (Yusuke Wada, committer noreply@github.com). It is an ancestor of HEAD, and HEAD's history has no TuxCare/CloudLinux commit, so the fix shipped ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56762" }, "impact_statement": "not_affected \u2014 The target already contains the upstream fix. _serialize() in src/utils/cookie.ts rejects cookie names that do not match the RFC 6265 token regex, and serialize(), serializeSigned() and setCookie() all go through it. The fix is upstream commit a586cd72 (Yusuke Wada, committer noreply@github.com). It is an ancestor of HEAD, and HEAD's history has no TuxCare/CloudLinux commit, so the fix shipped ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:55:00.037891+00:00", "status_notes": "Vulnerability CVE-2026-56763 does not affect version 4.12.25 of hono. not_affected \u2014 The vendor fix (upstream commit ef902257, Taku Amano) is already in HEAD. src/utils/body.ts handleParsingNestedValues returns early on any key with a __proto__ path segment followed by a dot. The fix shipped in upstream release 4.12.25, before any TuxCare commit, so the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56763" }, "impact_statement": "not_affected \u2014 The vendor fix (upstream commit ef902257, Taku Amano) is already in HEAD. src/utils/body.ts handleParsingNestedValues returns early on any key with a __proto__ path segment followed by a dot. The fix shipped in upstream release 4.12.25, before any TuxCare commit, so the verdict is not_affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-10-15T13:01:46.153746+00:00", "status_notes": "Vulnerability CVE-2026-59895 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2026-59895" }, "action_statement": "Vulnerability CVE-2026-59895 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-10-15T13:01:46.153746+00:00", "status_notes": "Vulnerability CVE-2026-59896 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2026-59896" }, "action_statement": "Vulnerability CVE-2026-59896 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-10-15T13:01:46.153746+00:00", "status_notes": "Vulnerability CVE-2026-59897 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2026-59897" }, "action_statement": "Vulnerability CVE-2026-59897 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-10-15T13:01:46.153746+00:00", "status_notes": "Vulnerability CVE-2026-69207 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2026-69207" }, "action_statement": "Vulnerability CVE-2026-69207 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-10-15T13:00:40.103707+00:00", "status_notes": "Vulnerability CVE-2026-71848 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2026-71848" }, "action_statement": "Vulnerability CVE-2026-71848 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-10-15T13:00:40.103707+00:00", "status_notes": "Vulnerability CVE-2026-71849 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2026-71849" }, "action_statement": "Vulnerability CVE-2026-71849 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-10-15T13:00:40.103707+00:00", "status_notes": "Vulnerability CVE-2026-71850 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2026-71850" }, "action_statement": "Vulnerability CVE-2026-71850 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-10-15T13:00:40.103707+00:00", "status_notes": "Vulnerability CVE-2026-84363 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2026-84363" }, "action_statement": "Vulnerability CVE-2026-84363 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-10-15T13:00:40.103707+00:00", "status_notes": "Vulnerability CVE-2026-84364 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2026-84364" }, "action_statement": "Vulnerability CVE-2026-84364 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-10-15T13:00:40.103707+00:00", "status_notes": "Vulnerability CVE-2026-84365 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2026-84365" }, "action_statement": "Vulnerability CVE-2026-84365 affects version 4.12.25 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-10-15T13:00:40.103707+00:00", "status_notes": "Vulnerability CVE-2026-93981 affects version 4.12.25 of hono.", "vulnerability": { "name": "CVE-2026-93981" }, "action_statement": "Vulnerability CVE-2026-93981 affects version 4.12.25 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability GHSA-3wcj-gjvf-fvch is a false positive for hono 4.12.25.", "vulnerability": { "name": "GHSA-3wcj-gjvf-fvch" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability GHSA-55cm-p4ww-685g is a false positive for hono 4.12.25.", "vulnerability": { "name": "GHSA-55cm-p4ww-685g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-10-26T21:00:17.311477+00:00", "status_notes": "Vulnerability GHSA-6623-4q32-82v8 is a false positive for hono 4.12.25.", "vulnerability": { "name": "GHSA-6623-4q32-82v8" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability GHSA-cw3j-28qq-x3xh is a false positive for hono 4.12.25.", "vulnerability": { "name": "GHSA-cw3j-28qq-x3xh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.25", "identifiers": { "purl": "pkg:npm/hono@4.12.25" } } ], "timestamp": "2026-11-13T19:51:24.435252+00:00", "status_notes": "Vulnerability GHSA-gq3j-xvxp-8hrf does not affect version 4.12.25 of hono. not_affected \u2014 The upstream fix (honojs/hono 91def7ca, \"fixed to be more properly timing safe\") is already in this tree at 4.12.25. timingSafeEqualString now uses a constant-time XOR/OR loop (constantTimeEqualString) instead of `===`. The fix shipped in the upstream 4.12.25 release and was authored by upstream, not TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-gq3j-xvxp-8hrf" }, "impact_statement": "not_affected \u2014 The upstream fix (honojs/hono 91def7ca, \"fixed to be more properly timing safe\") is already in this tree at 4.12.25. timingSafeEqualString now uses a constant-time XOR/OR loop (constantTimeEqualString) instead of `===`. The fix shipped in the upstream 4.12.25 release and was authored by upstream, not TuxCare." } ] }