{ "@id": "urn:uuid:bac4f456-d9d4-404d-92f8-679d5f20d572", "role": "Document Creator", "author": "https://tuxcare.com", "version": 30, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T16:02:16.476661+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2023-50710 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2023-50710" }, "action_statement": "Vulnerability CVE-2023-50710 affects version 4.12.26 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-32869 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2024-32869" }, "action_statement": "Vulnerability CVE-2024-32869 affects version 4.12.26 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-43787 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2024-43787" }, "action_statement": "Vulnerability CVE-2024-43787 affects version 4.12.26 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-48913 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2024-48913" }, "action_statement": "Vulnerability CVE-2024-48913 affects version 4.12.26 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-58362 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2025-58362" }, "action_statement": "Vulnerability CVE-2025-58362 affects version 4.12.26 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-59139 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2025-59139" }, "action_statement": "Vulnerability CVE-2025-59139 affects version 4.12.26 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-62610 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2025-62610" }, "action_statement": "Vulnerability CVE-2025-62610 affects version 4.12.26 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-10-29T20:31:24.273560+00:00", "status_notes": "Vulnerability CVE-2025-71381 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2025-71381" }, "action_statement": "Vulnerability CVE-2025-71381 affects version 4.12.26 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-10-20T14:42:09.335337+00:00", "status_notes": "Vulnerability CVE-2026-111757 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2026-111757" }, "action_statement": "Vulnerability CVE-2026-111757 affects version 4.12.26 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-12T23:39:00.066400+00:00", "status_notes": "Vulnerability CVE-2026-126355 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2026-126355" }, "action_statement": "Vulnerability CVE-2026-126355 affects version 4.12.26 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-12T23:39:00.066400+00:00", "status_notes": "Vulnerability CVE-2026-126356 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2026-126356" }, "action_statement": "Vulnerability CVE-2026-126356 affects version 4.12.26 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126357 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2026-126357" }, "action_statement": "Vulnerability CVE-2026-126357 affects version 4.12.26 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126358 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2026-126358" }, "action_statement": "Vulnerability CVE-2026-126358 affects version 4.12.26 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126359 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2026-126359" }, "action_statement": "Vulnerability CVE-2026-126359 affects version 4.12.26 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-22817 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2026-22817" }, "action_statement": "Vulnerability CVE-2026-22817 affects version 4.12.26 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-22818 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2026-22818" }, "action_statement": "Vulnerability CVE-2026-22818 affects version 4.12.26 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:51:00.041863+00:00", "status_notes": "Vulnerability CVE-2026-24398 does not affect version 4.12.26 of hono. not_affected \u2014 The upstream fix for CVE-2026-24398 (hono commit edbf6eea) is already in HEAD. IPV4_REGEX now restricts each octet to 0-255, and the IPv4 converter rejects any octet above 255. The fix commit was authored upstream by yusuke@kamawada.com. No TuxCare/CloudLinux-domain commit exists in the history, so the fix came with the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24398" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-24398 (hono commit edbf6eea) is already in HEAD. IPV4_REGEX now restricts each octet to 0-255, and the IPv4 converter rejects any octet above 255. The fix commit was authored upstream by yusuke@kamawada.com. No TuxCare/CloudLinux-domain commit exists in the history, so the fix came with the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:47:35.365109+00:00", "status_notes": "Vulnerability CVE-2026-24472 does not affect version 4.12.26 of hono. not_affected \u2014 Hono 4.12.26 already contains the upstream fix for CVE-2026-24472. The cache middleware checks the response's Cache-Control header and refuses to cache responses carrying private, no-store or no-cache. The fix is upstream commit 12c511745b3f, authored by simon@koeck.dev. It is an ancestor of the 4.12.26 release commit, so it shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24472" }, "impact_statement": "not_affected \u2014 Hono 4.12.26 already contains the upstream fix for CVE-2026-24472. The cache middleware checks the response's Cache-Control header and refuses to cache responses carrying private, no-store or no-cache. The fix is upstream commit 12c511745b3f, authored by simon@koeck.dev. It is an ancestor of the 4.12.26 release commit, so it shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:51:00.041863+00:00", "status_notes": "Vulnerability CVE-2026-24473 does not affect version 4.12.26 of hono. not_affected \u2014 The upstream fix for CVE-2026-24473 (honojs/hono cf9a78db, a one-line change in src/adapter/cloudflare-workers/utils.ts) is already present in this target (hono 4.12.26). getContentFromKVAsset now looks the key up only through the asset manifest, with no fallback to the raw request path. The target is therefore not exposed to the arbitrary-key read. The fix was authored upstream and shipped in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24473" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-24473 (honojs/hono cf9a78db, a one-line change in src/adapter/cloudflare-workers/utils.ts) is already present in this target (hono 4.12.26). getContentFromKVAsset now looks the key up only through the asset manifest, with no fallback to the raw request path. The target is therefore not exposed to the arbitrary-key read. The fix was authored upstream and shipped in ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:49:00.036571+00:00", "status_notes": "Vulnerability CVE-2026-24771 does not affect version 4.12.26 of hono. not_affected \u2014 Target hono 4.12.26 already contains the upstream fix for CVE-2026-24771 (commit 2cf60046, \"Merge commit from fork\", by Taku Amano). ErrorBoundary no longer forces raw HTML on string children or fallback output; strings are escaped through Fragment/jsx. The fix shipped in the upstream release, and HEAD has no TuxCare-domain commits, so this is an upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24771" }, "impact_statement": "not_affected \u2014 Target hono 4.12.26 already contains the upstream fix for CVE-2026-24771 (commit 2cf60046, \"Merge commit from fork\", by Taku Amano). ErrorBoundary no longer forces raw HTML on string children or fallback output; strings are escaped through Fragment/jsx. The fix shipped in the upstream release, and HEAD has no TuxCare-domain commits, so this is an upstream fix." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-27700 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2026-27700" }, "action_statement": "Vulnerability CVE-2026-27700 affects version 4.12.26 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:46:29.389576+00:00", "status_notes": "Vulnerability CVE-2026-29045 does not affect version 4.12.26 of hono. not_affected \u2014 The upstream fix for CVE-2026-29045 is already in this tree (hono 4.12.26). serveStatic decodes the request path with tryDecodeURI, the same decoder the router uses. An encoded slash (%2F) therefore stays literal in both layers and cannot bypass route middleware. The fix commit is upstream-authored and was in the upstream release before any TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29045" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-29045 is already in this tree (hono 4.12.26). serveStatic decodes the request path with tryDecodeURI, the same decoder the router uses. An encoded slash (%2F) therefore stays literal in both layers and cannot bypass route middleware. The fix commit is upstream-authored and was in the upstream release before any TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:51:00.041863+00:00", "status_notes": "Vulnerability CVE-2026-29085 does not affect version 4.12.26 of hono. not_affected \u2014 Hono 4.12.26 already contains the upstream fix for CVE-2026-29085. SSEStreamingApi.writeSSE in src/helper/streaming/sse.ts throws if event, id or retry contains CR or LF. The fix commit f4123ed9 is by upstream author taku@taaas.jp and is in the upstream 4.12.26 release. No TuxCare commit was involved.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29085" }, "impact_statement": "not_affected \u2014 Hono 4.12.26 already contains the upstream fix for CVE-2026-29085. SSEStreamingApi.writeSSE in src/helper/streaming/sse.ts throws if event, id or retry contains CR or LF. The fix commit f4123ed9 is by upstream author taku@taaas.jp and is in the upstream 4.12.26 release. No TuxCare commit was involved." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:49:46.782400+00:00", "status_notes": "Vulnerability CVE-2026-29086 does not affect version 4.12.26 of hono. not_affected \u2014 Target hono 4.12.26 already contains the upstream fix for CVE-2026-29086. _serialize() in src/utils/cookie.ts throws if domain, path, sameSite or priority contains ';', '\\r' or '\\n'. The fix is upstream commit 44ae0c8c by Taku Amano, which is an ancestor of the 4.12.26 release commit and ships in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29086" }, "impact_statement": "not_affected \u2014 Target hono 4.12.26 already contains the upstream fix for CVE-2026-29086. _serialize() in src/utils/cookie.ts throws if domain, path, sameSite or priority contains ';', '\\r' or '\\n'. The fix is upstream commit 44ae0c8c by Taku Amano, which is an ancestor of the 4.12.26 release commit and ships in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:46:52.537695+00:00", "status_notes": "Vulnerability CVE-2026-39407 does not affect version 4.12.26 of hono. not_affected \u2014 Hono 4.12.26 already contains the upstream fix for CVE-2026-39407. serveStatic rejects any decoded request path containing consecutive slashes or backslashes, so //admin/secret.txt is never resolved to admin/secret.txt. The fix commit 9aff14bd (author taku@taaas.jp) is an ancestor of HEAD and shipped in the upstream release. HEAD has no TuxCare-domain commits, so this is an upstream fix and not...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39407" }, "impact_statement": "not_affected \u2014 Hono 4.12.26 already contains the upstream fix for CVE-2026-39407. serveStatic rejects any decoded request path containing consecutive slashes or backslashes, so //admin/secret.txt is never resolved to admin/secret.txt. The fix commit 9aff14bd (author taku@taaas.jp) is an ancestor of HEAD and shipped in the upstream release. HEAD has no TuxCare-domain commits, so this is an upstream fix and not..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:46:10.587778+00:00", "status_notes": "Vulnerability CVE-2026-39408 does not affect version 4.12.26 of hono. not_affected \u2014 The target (hono 4.12.26) already contains the upstream fix for CVE-2026-39408 (commit b470278, authored by Yusuke Wada). It was shipped in the upstream 4.12.26 release, so the path traversal pattern is not present in HEAD. generateFilePath() calls ensureWithinOutDir() before any file is written.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39408" }, "impact_statement": "not_affected \u2014 The target (hono 4.12.26) already contains the upstream fix for CVE-2026-39408 (commit b470278, authored by Yusuke Wada). It was shipped in the upstream 4.12.26 release, so the path traversal pattern is not present in HEAD. generateFilePath() calls ensureWithinOutDir() before any file is written." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:49:46.782400+00:00", "status_notes": "Vulnerability CVE-2026-39409 does not affect version 4.12.26 of hono. not_affected \u2014 Hono 4.12.26 already contains the upstream fix for CVE-2026-39409 (commit 48fa2233, authored by yusuke@kamawada.com). ipRestriction() converts IPv4-mapped IPv6 client addresses to IPv4 before matching, for static and CIDR rules. HEAD's history has no TuxCare-domain commits, so the fix shipped in the upstream release and the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39409" }, "impact_statement": "not_affected \u2014 Hono 4.12.26 already contains the upstream fix for CVE-2026-39409 (commit 48fa2233, authored by yusuke@kamawada.com). ipRestriction() converts IPv4-mapped IPv6 client addresses to IPv4 before matching, for static and CIDR rules. HEAD's history has no TuxCare-domain commits, so the fix shipped in the upstream release and the verdict is not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:52:00.137305+00:00", "status_notes": "Vulnerability CVE-2026-39410 does not affect version 4.12.26 of hono. not_affected \u2014 Hono 4.12.26 already contains the upstream fix for CVE-2026-39410. The cookie parser in src/utils/cookie.ts trims only SP (0x20) and HTAB (0x09), not JavaScript's broader trim() set that includes U+00A0. A cookie named with a U+00A0 prefix therefore stays distinct and fails the name-validation regex. The fix commit cc067c85 is upstream-authored and ships in the 4.12.26 release that was onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39410" }, "impact_statement": "not_affected \u2014 Hono 4.12.26 already contains the upstream fix for CVE-2026-39410. The cookie parser in src/utils/cookie.ts trims only SP (0x20) and HTAB (0x09), not JavaScript's broader trim() set that includes U+00A0. A cookie named with a U+00A0 prefix therefore stays distinct and fails the name-validation regex. The fix commit cc067c85 is upstream-authored and ships in the 4.12.26 release that was onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:48:00.051925+00:00", "status_notes": "Vulnerability CVE-2026-44455 does not affect version 4.12.26 of hono. not_affected \u2014 Target (hono 4.12.26) already contains the upstream fix for CVE-2026-44455: JSXNode's constructor validates string tag names via isValidTagName and throws on invalid names. The fix commit 614b834551378bffff70c810b2295495bc6e4d55 is authored by upstream (taku@taaas.jp) and shipped within the 4.12.26 release before any TuxCare commit, so the vulnerable pattern is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44455" }, "impact_statement": "not_affected \u2014 Target (hono 4.12.26) already contains the upstream fix for CVE-2026-44455: JSXNode's constructor validates string tag names via isValidTagName and throws on invalid names. The fix commit 614b834551378bffff70c810b2295495bc6e4d55 is authored by upstream (taku@taaas.jp) and shipped within the 4.12.26 release before any TuxCare commit, so the vulnerable pattern is not present." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:49:00.036571+00:00", "status_notes": "Vulnerability CVE-2026-44456 does not affect version 4.12.26 of hono. not_affected \u2014 The upstream fix (hono commit db05b96d, \"Merge commit from fork\", author yusuke@kamawada.com) is already in the target 4.12.26 source. bodyLimit() now reads chunked or unknown-length bodies up-front and decides on size before calling next(). The fix shipped in the upstream release, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44456" }, "impact_statement": "not_affected \u2014 The upstream fix (hono commit db05b96d, \"Merge commit from fork\", author yusuke@kamawada.com) is already in the target 4.12.26 source. bodyLimit() now reads chunked or unknown-length bodies up-front and decides on size before calling next(). The fix shipped in the upstream release, so the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:44:00.117801+00:00", "status_notes": "Vulnerability CVE-2026-44457 does not affect version 4.12.26 of hono. not_affected \u2014 Hono 4.12.26 already contains the upstream fix (commit 568c2ecc, \"Merge commit from fork\"). The cache middleware skips any response that carries a Vary header not covered by the middleware's own vary option. It also bypasses the cache for non-GET requests and for requests carrying Authorization. The commit is in the upstream 4.12.26 release and is not TuxCare-authored.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44457" }, "impact_statement": "not_affected \u2014 Hono 4.12.26 already contains the upstream fix (commit 568c2ecc, \"Merge commit from fork\"). The cache middleware skips any response that carries a Vary header not covered by the middleware's own vary option. It also bypasses the cache for non-GET requests and for requests carrying Authorization. The commit is in the upstream 4.12.26 release and is not TuxCare-authored." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:43:16.611537+00:00", "status_notes": "Vulnerability CVE-2026-44458 does not affect version 4.12.26 of hono. not_affected \u2014 The upstream fix for CVE-2026-44458 (honojs/hono commit 58d3d3ad, \"prevent CSS injection via ; in style object values\") is already in the target at 4.12.26. It shipped in the upstream release, before any TuxCare commit. Both server-side JSX style-object serializers go through the hardened styleObjectForEach, which validates property names and rejects unsafe values.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44458" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-44458 (honojs/hono commit 58d3d3ad, \"prevent CSS injection via ; in style object values\") is already in the target at 4.12.26. It shipped in the upstream release, before any TuxCare commit. Both server-side JSX style-object serializers go through the hardened styleObjectForEach, which validates property names and rejects unsafe values." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:39:32.180152+00:00", "status_notes": "Vulnerability CVE-2026-44459 does not affect version 4.12.26 of hono. not_affected \u2014 The upstream fix (honojs/hono a5bd9ebe) is already in the shipped 4.12.26 release. verify() in src/utils/jwt/jwt.ts rejects present-but-malformed nbf/exp/iat claims (non-number, non-finite, or out of range). The fix commit was authored by upstream (yusuke@kamawada.com) and is not TuxCare work, so the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44459" }, "impact_statement": "not_affected \u2014 The upstream fix (honojs/hono a5bd9ebe) is already in the shipped 4.12.26 release. verify() in src/utils/jwt/jwt.ts rejects present-but-malformed nbf/exp/iat claims (non-number, non-finite, or out of range). The fix commit was authored by upstream (yusuke@kamawada.com) and is not TuxCare work, so the verdict is not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:41:00.162773+00:00", "status_notes": "Vulnerability CVE-2026-47673 does not affect version 4.12.26 of hono. not_affected \u2014 The jwt and jwk middlewares already reject any Authorization header whose first token is not 'bearer' (case-insensitive). The fix is the upstream commit 5463db27 (author taku@taaas.jp). It is an ancestor of HEAD, and HEAD has no TuxCare-domain commits, so it counts as an upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47673" }, "impact_statement": "not_affected \u2014 The jwt and jwk middlewares already reject any Authorization header whose first token is not 'bearer' (case-insensitive). The fix is the upstream commit 5463db27 (author taku@taaas.jp). It is an ancestor of HEAD, and HEAD has no TuxCare-domain commits, so it counts as an upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:41:53.414094+00:00", "status_notes": "Vulnerability CVE-2026-47674 does not affect version 4.12.26 of hono. not_affected \u2014 The upstream fix (commit c831020f, \"match static IP rules numerically\", by Taku Amano) is already in HEAD. It shipped in the upstream hono 4.12.26 release, and no commit in HEAD's history has a TuxCare/CloudLinux author email. ip-restriction now matches static rules by numeric binary value and rejects invalid addresses. Non-canonical IPv6 forms no longer bypass static deny rules.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47674" }, "impact_statement": "not_affected \u2014 The upstream fix (commit c831020f, \"match static IP rules numerically\", by Taku Amano) is already in HEAD. It shipped in the upstream hono 4.12.26 release, and no commit in HEAD's history has a TuxCare/CloudLinux author email. ip-restriction now matches static rules by numeric binary value and rejects invalid addresses. Non-canonical IPv6 forms no longer bypass static deny rules." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:40:10.835154+00:00", "status_notes": "Vulnerability CVE-2026-47675 does not affect version 4.12.26 of hono. not_affected \u2014 The target (hono 4.12.26) already contains the upstream fix for CVE-2026-47675. serialize() in src/utils/cookie.ts rejects ';', '\\r' and '\\n' in sameSite and priority, as well as domain and path. The fix is upstream commit 905aedbc, authored by taku@taaas.jp and committed by noreply@github.com. It is an ancestor of HEAD and of the upstream 4.12.26 release commit, so it shipped in the upstream r...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47675" }, "impact_statement": "not_affected \u2014 The target (hono 4.12.26) already contains the upstream fix for CVE-2026-47675. serialize() in src/utils/cookie.ts rejects ';', '\\r' and '\\n' in sameSite and priority, as well as domain and path. The fix is upstream commit 905aedbc, authored by taku@taaas.jp and committed by noreply@github.com. It is an ancestor of HEAD and of the upstream 4.12.26 release commit, so it shipped in the upstream r..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:45:49.219313+00:00", "status_notes": "Vulnerability CVE-2026-47676 does not affect version 4.12.26 of hono. not_affected \u2014 Not affected. The upstream fix for CVE-2026-47676 (honojs/hono 6cbb025f) is already in the target. Hono 4.12.26 shipped with it. In mount(), replaceRequest slices this.getPath(request), the same decoded path that routing matches on, instead of the raw url.pathname. The TuxCare history has no commits from @cloudlinux.com or @tuxcare.com addresses.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47676" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2026-47676 (honojs/hono 6cbb025f) is already in the target. Hono 4.12.26 shipped with it. In mount(), replaceRequest slices this.getPath(request), the same decoded path that routing matches on, instead of the raw url.pathname. The TuxCare history has no commits from @cloudlinux.com or @tuxcare.com addresses." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:41:00.162773+00:00", "status_notes": "Vulnerability CVE-2026-54286 does not affect version 4.12.26 of hono. not_affected \u2014 Not affected. Both upstream fixes for CVE-2026-54286 are already in the target (hono 4.12.26): the serve-static guard rejects any decoded path containing a backslash, and the path normalizer replaces all backslashes. The fix commits are upstream-authored and shipped in the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54286" }, "impact_statement": "not_affected \u2014 Not affected. Both upstream fixes for CVE-2026-54286 are already in the target (hono 4.12.26): the serve-static guard rejects any decoded path containing a backslash, and the path normalizer replaces all backslashes. The fix commits are upstream-authored and shipped in the upstream release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:44:00.117801+00:00", "status_notes": "Vulnerability CVE-2026-54287 does not affect version 4.12.26 of hono. not_affected \u2014 The target (hono 4.12.26) already contains the upstream fix. ALBProcessor.setCookiesToResult no longer joins Set-Cookie values with ', ' (it emits cookies[0] in single-header mode), and LatticeV2Processor.setCookiesToResult emits an array. The fix was authored upstream by Yusuke Wada (commit 7ae7cbae) and shipped in the upstream release before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54287" }, "impact_statement": "not_affected \u2014 The target (hono 4.12.26) already contains the upstream fix. ALBProcessor.setCookiesToResult no longer joins Set-Cookie values with ', ' (it emits cookies[0] in single-header mode), and LatticeV2Processor.setCookiesToResult emits an array. The fix was authored upstream by Yusuke Wada (commit 7ae7cbae) and shipped in the upstream release before the first TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:41:00.162773+00:00", "status_notes": "Vulnerability CVE-2026-54288 does not affect version 4.12.26 of hono. not_affected \u2014 The vendor fix for CVE-2026-54288 (upstream commits fa5f9bfc and e50df014) is already in this tree, which is the upstream 4.12.26 release. Both Lambda adapters now overwrite Content-Length with the real decoded body length, so bodyLimit can no longer be bypassed with an understated header.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54288" }, "impact_statement": "not_affected \u2014 The vendor fix for CVE-2026-54288 (upstream commits fa5f9bfc and e50df014) is already in this tree, which is the upstream 4.12.26 release. Both Lambda adapters now overwrite Content-Length with the real decoded body length, so bodyLimit can no longer be bypassed with an understated header." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:45:36.334046+00:00", "status_notes": "Vulnerability CVE-2026-54289 does not affect version 4.12.26 of hono. not_affected \u2014 The target (hono 4.12.26) already appends every CloudFront header entry in the Lambda@Edge adapter, so repeated headers such as X-Forwarded-For are not truncated. The fix came from upstream commit 3892a6c2, which is an ancestor of HEAD and shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54289" }, "impact_statement": "not_affected \u2014 The target (hono 4.12.26) already appends every CloudFront header entry in the Lambda@Edge adapter, so repeated headers such as X-Forwarded-For are not truncated. The fix came from upstream commit 3892a6c2, which is an ancestor of HEAD and shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:45:02.967150+00:00", "status_notes": "Vulnerability CVE-2026-54290 does not affect version 4.12.26 of hono. not_affected \u2014 Hono 4.12.26 already contains the upstream fix f0b094db (GHSA merge from fork). The CORS middleware no longer reflects the request Origin when credentials is true with the default wildcard origin. It emits the literal '*', which browsers reject for credentialed requests. The fix shipped in the upstream 4.12.26 release, before the first TuxCare commit, so the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54290" }, "impact_statement": "not_affected \u2014 Hono 4.12.26 already contains the upstream fix f0b094db (GHSA merge from fork). The CORS middleware no longer reflects the request Origin when credentials is true with the default wildcard origin. It emits the literal '*', which browsers reject for credentialed requests. The fix shipped in the upstream 4.12.26 release, before the first TuxCare commit, so the verdict is not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:49:46.782400+00:00", "status_notes": "Vulnerability CVE-2026-56761 does not affect version 4.12.26 of hono. not_affected \u2014 The upstream fix (honojs/hono 66daa2ed) is already in the 4.12.26 release this branch is based on. hono/jsx validates attribute names with isValidAttributeName() and drops invalid ones before emitting HTML, on both SSR paths.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56761" }, "impact_statement": "not_affected \u2014 The upstream fix (honojs/hono 66daa2ed) is already in the 4.12.26 release this branch is based on. hono/jsx validates attribute names with isValidAttributeName() and drops invalid ones before emitting HTML, on both SSR paths." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:54:29.457147+00:00", "status_notes": "Vulnerability CVE-2026-56762 does not affect version 4.12.26 of hono. not_affected \u2014 The upstream fix (a586cd72) is already in HEAD as part of the 4.12.26 release. _serialize() in src/utils/cookie.ts rejects any cookie name that does not match the RFC 6265 token regex, so setCookie, serialize and serializeSigned throw before a Set-Cookie value is built from an invalid name. The target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56762" }, "impact_statement": "not_affected \u2014 The upstream fix (a586cd72) is already in HEAD as part of the 4.12.26 release. _serialize() in src/utils/cookie.ts rejects any cookie name that does not match the RFC 6265 token regex, so setCookie, serialize and serializeSigned throw before a Set-Cookie value is built from an invalid name. The target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:55:26.538286+00:00", "status_notes": "Vulnerability CVE-2026-56763 does not affect version 4.12.26 of hono. not_affected \u2014 The upstream fix (ef902257, \"Merge commit from fork\") is already in HEAD. It sits in the upstream 4.12.26 release, which came before any TuxCare commit. handleParsingNestedValues in src/utils/body.ts now returns early for keys with a `__proto__.` path segment, so `__proto__.x` and `a.__proto__.x` no longer produce a `__proto__` property.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56763" }, "impact_statement": "not_affected \u2014 The upstream fix (ef902257, \"Merge commit from fork\") is already in HEAD. It sits in the upstream 4.12.26 release, which came before any TuxCare commit. handleParsingNestedValues in src/utils/body.ts now returns early for keys with a `__proto__.` path segment, so `__proto__.x` and `a.__proto__.x` no longer produce a `__proto__` property." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-14T16:02:16.476661+00:00", "status_notes": "Vulnerability CVE-2026-59895 affects version 4.12.26 of hono, and is fixed in 4.12.26-tuxcare.1.", "vulnerability": { "name": "CVE-2026-59895" }, "action_statement": "Vulnerability CVE-2026-59895 affects version 4.12.26 of hono, and is fixed in 4.12.26-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-14T16:02:16.476661+00:00", "status_notes": "Vulnerability CVE-2026-59896 affects version 4.12.26 of hono, and is fixed in 4.12.26-tuxcare.1.", "vulnerability": { "name": "CVE-2026-59896" }, "action_statement": "Vulnerability CVE-2026-59896 affects version 4.12.26 of hono, and is fixed in 4.12.26-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-14T16:02:16.476661+00:00", "status_notes": "Vulnerability CVE-2026-59897 affects version 4.12.26 of hono, and is fixed in 4.12.26-tuxcare.1.", "vulnerability": { "name": "CVE-2026-59897" }, "action_statement": "Vulnerability CVE-2026-59897 affects version 4.12.26 of hono, and is fixed in 4.12.26-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-10-15T13:01:46.153746+00:00", "status_notes": "Vulnerability CVE-2026-69207 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2026-69207" }, "action_statement": "Vulnerability CVE-2026-69207 affects version 4.12.26 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-10-15T13:01:46.153746+00:00", "status_notes": "Vulnerability CVE-2026-71848 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2026-71848" }, "action_statement": "Vulnerability CVE-2026-71848 affects version 4.12.26 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-10-15T13:01:46.153746+00:00", "status_notes": "Vulnerability CVE-2026-71849 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2026-71849" }, "action_statement": "Vulnerability CVE-2026-71849 affects version 4.12.26 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-10-15T13:01:46.153746+00:00", "status_notes": "Vulnerability CVE-2026-71850 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2026-71850" }, "action_statement": "Vulnerability CVE-2026-71850 affects version 4.12.26 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-10-15T13:01:46.153746+00:00", "status_notes": "Vulnerability CVE-2026-84363 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2026-84363" }, "action_statement": "Vulnerability CVE-2026-84363 affects version 4.12.26 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-10-15T13:01:46.153746+00:00", "status_notes": "Vulnerability CVE-2026-84364 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2026-84364" }, "action_statement": "Vulnerability CVE-2026-84364 affects version 4.12.26 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-10-15T13:01:46.153746+00:00", "status_notes": "Vulnerability CVE-2026-84365 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2026-84365" }, "action_statement": "Vulnerability CVE-2026-84365 affects version 4.12.26 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-09-30T23:54:00.098505+00:00", "status_notes": "Vulnerability CVE-2026-93981 affects version 4.12.26 of hono.", "vulnerability": { "name": "CVE-2026-93981" }, "action_statement": "Vulnerability CVE-2026-93981 affects version 4.12.26 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability GHSA-3wcj-gjvf-fvch is a false positive for hono 4.12.26.", "vulnerability": { "name": "GHSA-3wcj-gjvf-fvch" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability GHSA-55cm-p4ww-685g is a false positive for hono 4.12.26.", "vulnerability": { "name": "GHSA-55cm-p4ww-685g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-6623-4q32-82v8 is a false positive for hono 4.12.26.", "vulnerability": { "name": "GHSA-6623-4q32-82v8" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability GHSA-cw3j-28qq-x3xh is a false positive for hono 4.12.26.", "vulnerability": { "name": "GHSA-cw3j-28qq-x3xh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.26", "identifiers": { "purl": "pkg:npm/hono@4.12.26" } } ], "timestamp": "2026-11-13T19:52:00.137305+00:00", "status_notes": "Vulnerability GHSA-gq3j-xvxp-8hrf does not affect version 4.12.26 of hono. not_affected \u2014 Hono 4.12.26 already contains the upstream fix for GHSA-gq3j-xvxp-8hrf. src/utils/buffer.ts no longer compares hashes with ===. timingSafeEqualString now uses constantTimeEqualString, which scans the full length of both strings and accumulates differences with XOR/OR. The fix commit 91def7cab654bad5eecc9270e6620d577971ff5e is upstream-authored and is an ancestor of the upstream release commit 2...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-gq3j-xvxp-8hrf" }, "impact_statement": "not_affected \u2014 Hono 4.12.26 already contains the upstream fix for GHSA-gq3j-xvxp-8hrf. src/utils/buffer.ts no longer compares hashes with ===. timingSafeEqualString now uses constantTimeEqualString, which scans the full length of both strings and accumulates differences with XOR/OR. The fix commit 91def7cab654bad5eecc9270e6620d577971ff5e is upstream-authored and is an ancestor of the upstream release commit 2..." } ] }