{ "@id": "urn:uuid:28b14d4f-0049-40d2-8ffe-fc43472408dc", "role": "Document Creator", "author": "https://tuxcare.com", "version": 30, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T19:55:00.037891+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2023-50710 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2023-50710" }, "action_statement": "Vulnerability CVE-2023-50710 affects version 4.12.27 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-32869 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2024-32869" }, "action_statement": "Vulnerability CVE-2024-32869 affects version 4.12.27 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-43787 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2024-43787" }, "action_statement": "Vulnerability CVE-2024-43787 affects version 4.12.27 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-48913 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2024-48913" }, "action_statement": "Vulnerability CVE-2024-48913 affects version 4.12.27 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-58362 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2025-58362" }, "action_statement": "Vulnerability CVE-2025-58362 affects version 4.12.27 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-59139 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2025-59139" }, "action_statement": "Vulnerability CVE-2025-59139 affects version 4.12.27 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-62610 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2025-62610" }, "action_statement": "Vulnerability CVE-2025-62610 affects version 4.12.27 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-10-29T20:31:24.273560+00:00", "status_notes": "Vulnerability CVE-2025-71381 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2025-71381" }, "action_statement": "Vulnerability CVE-2025-71381 affects version 4.12.27 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-10-20T14:41:00.226982+00:00", "status_notes": "Vulnerability CVE-2026-111757 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2026-111757" }, "action_statement": "Vulnerability CVE-2026-111757 affects version 4.12.27 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-12T23:39:00.066400+00:00", "status_notes": "Vulnerability CVE-2026-126355 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2026-126355" }, "action_statement": "Vulnerability CVE-2026-126355 affects version 4.12.27 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-12T23:39:00.066400+00:00", "status_notes": "Vulnerability CVE-2026-126356 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2026-126356" }, "action_statement": "Vulnerability CVE-2026-126356 affects version 4.12.27 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126357 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2026-126357" }, "action_statement": "Vulnerability CVE-2026-126357 affects version 4.12.27 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126358 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2026-126358" }, "action_statement": "Vulnerability CVE-2026-126358 affects version 4.12.27 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126359 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2026-126359" }, "action_statement": "Vulnerability CVE-2026-126359 affects version 4.12.27 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-22817 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2026-22817" }, "action_statement": "Vulnerability CVE-2026-22817 affects version 4.12.27 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-22818 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2026-22818" }, "action_statement": "Vulnerability CVE-2026-22818 affects version 4.12.27 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:51:00.041863+00:00", "status_notes": "Vulnerability CVE-2026-24398 does not affect version 4.12.27 of hono. not_affected \u2014 The target (hono 4.12.27) already contains the upstream fix for CVE-2026-24398. IPV4_REGEX is now strict (each octet limited to 0-255) and the IPv4 parser rejects any octet above 255. The fix commit edbf6eea is authored by upstream (yusuke@kamawada.com), is an ancestor of HEAD, and HEAD has no TuxCare-domain commits, so it shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24398" }, "impact_statement": "not_affected \u2014 The target (hono 4.12.27) already contains the upstream fix for CVE-2026-24398. IPV4_REGEX is now strict (each octet limited to 0-255) and the IPv4 parser rejects any octet above 255. The fix commit edbf6eea is authored by upstream (yusuke@kamawada.com), is an ancestor of HEAD, and HEAD has no TuxCare-domain commits, so it shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:47:35.365109+00:00", "status_notes": "Vulnerability CVE-2026-24472 does not affect version 4.12.27 of hono. not_affected \u2014 Hono 4.12.27 already contains the upstream fix for CVE-2026-24472. The cache middleware skips caching responses whose Cache-Control contains private, no-store or no-cache. The fix is upstream commit 12c511745b3f (author simon@koeck.dev, committer noreply@github.com), which is an ancestor of HEAD and shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24472" }, "impact_statement": "not_affected \u2014 Hono 4.12.27 already contains the upstream fix for CVE-2026-24472. The cache middleware skips caching responses whose Cache-Control contains private, no-store or no-cache. The fix is upstream commit 12c511745b3f (author simon@koeck.dev, committer noreply@github.com), which is an ancestor of HEAD and shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:52:00.137305+00:00", "status_notes": "Vulnerability CVE-2026-24473 does not affect version 4.12.27 of hono. not_affected \u2014 Hono 4.12.27 already contains the upstream fix for CVE-2026-24473. getContentFromKVAsset in the Cloudflare Workers adapter now looks the request path up only in the asset manifest (`ASSET_MANIFEST[path]`) and no longer falls back to the raw path as a KV key. The fix shipped in the upstream release, and the commit is not TuxCare-authored.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24473" }, "impact_statement": "not_affected \u2014 Hono 4.12.27 already contains the upstream fix for CVE-2026-24473. getContentFromKVAsset in the Cloudflare Workers adapter now looks the request path up only in the asset manifest (`ASSET_MANIFEST[path]`) and no longer falls back to the raw path as a KV key. The fix shipped in the upstream release, and the commit is not TuxCare-authored." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:48:18.808255+00:00", "status_notes": "Vulnerability CVE-2026-24771 does not affect version 4.12.27 of hono. not_affected \u2014 The upstream fix for CVE-2026-24771 (honojs/hono commit 2cf60046, \"Merge commit from fork\") is already present in the target (hono 4.12.27). It shipped in the upstream 4.12.27 release, which is IN_UPSTREAM_RELEASE. It is authored by taku@taaas.jp, outside the TuxCare allowlist, so the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24771" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-24771 (honojs/hono commit 2cf60046, \"Merge commit from fork\") is already present in the target (hono 4.12.27). It shipped in the upstream 4.12.27 release, which is IN_UPSTREAM_RELEASE. It is authored by taku@taaas.jp, outside the TuxCare allowlist, so the verdict is not_affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-27700 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2026-27700" }, "action_statement": "Vulnerability CVE-2026-27700 affects version 4.12.27 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:46:17.356729+00:00", "status_notes": "Vulnerability CVE-2026-29045 does not affect version 4.12.27 of hono. not_affected \u2014 Not affected. The upstream fix (commit 6a0607a9, 'replace decodeURIComponent with tryDecodeURI') is already in the shipped hono 4.12.27 release. serveStatic now decodes with tryDecodeURI, the same decodeURI semantics the router uses, so %2F is no longer turned into '/'. The fix is upstream-authored and predates the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29045" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix (commit 6a0607a9, 'replace decodeURIComponent with tryDecodeURI') is already in the shipped hono 4.12.27 release. serveStatic now decodes with tryDecodeURI, the same decodeURI semantics the router uses, so %2F is no longer turned into '/'. The fix is upstream-authored and predates the first TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:51:00.041863+00:00", "status_notes": "Vulnerability CVE-2026-29085 does not affect version 4.12.27 of hono. not_affected \u2014 Hono 4.12.27 already contains the upstream fix for CVE-2026-29085. SSEStreamingApi.writeSSE() in src/helper/streaming/sse.ts throws if event, id or retry contains CR or LF, so these fields cannot inject extra SSE fields. The fix is upstream commit f4123ed9 by Taku Amano, which is an ancestor of HEAD. HEAD's history has no TuxCare/CloudLinux-authored commit, so the fix shipped in the upstream re...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29085" }, "impact_statement": "not_affected \u2014 Hono 4.12.27 already contains the upstream fix for CVE-2026-29085. SSEStreamingApi.writeSSE() in src/helper/streaming/sse.ts throws if event, id or retry contains CR or LF, so these fields cannot inject extra SSE fields. The fix is upstream commit f4123ed9 by Taku Amano, which is an ancestor of HEAD. HEAD's history has no TuxCare/CloudLinux-authored commit, so the fix shipped in the upstream re..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:50:04.403996+00:00", "status_notes": "Vulnerability CVE-2026-29086 does not affect version 4.12.27 of hono. not_affected \u2014 Target hono 4.12.27 already contains the upstream fix for CVE-2026-29086. src/utils/cookie.ts rejects ';', '\\r' and '\\n' in the domain and path options (and sameSite and priority) before the Set-Cookie string is built. The fix is upstream commit 44ae0c8c, authored by taku@taaas.jp. It is an ancestor of HEAD and predates the only TuxCare-side commit, so it shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29086" }, "impact_statement": "not_affected \u2014 Target hono 4.12.27 already contains the upstream fix for CVE-2026-29086. src/utils/cookie.ts rejects ';', '\\r' and '\\n' in the domain and path options (and sameSite and priority) before the Set-Cookie string is built. The fix is upstream commit 44ae0c8c, authored by taku@taaas.jp. It is an ancestor of HEAD and predates the only TuxCare-side commit, so it shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:47:00.039124+00:00", "status_notes": "Vulnerability CVE-2026-39407 does not affect version 4.12.27 of hono. not_affected \u2014 serveStatic in this target (hono 4.12.27) already rejects request paths containing repeated slashes or backslashes. The fix is the upstream commit 9aff14bd, shipped in the upstream 4.12.27 release before any TuxCare commit, so the verdict is not_affected (upstream fix).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39407" }, "impact_statement": "not_affected \u2014 serveStatic in this target (hono 4.12.27) already rejects request paths containing repeated slashes or backslashes. The fix is the upstream commit 9aff14bd, shipped in the upstream 4.12.27 release before any TuxCare commit, so the verdict is not_affected (upstream fix)." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:46:10.587778+00:00", "status_notes": "Vulnerability CVE-2026-39408 does not affect version 4.12.27 of hono. not_affected \u2014 Hono 4.12.27 already contains the upstream fix for CVE-2026-39408. The fix is commit b470278920fffcfd6d76002755d6db53db827679, and it shipped in the upstream release the target is built on. generateFilePath() in src/helper/ssg/ssg.ts calls ensureWithinOutDir() on every output path before anything is written. The function is defined in src/helper/ssg/utils.ts and throws if the resolved path is o...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39408" }, "impact_statement": "not_affected \u2014 Hono 4.12.27 already contains the upstream fix for CVE-2026-39408. The fix is commit b470278920fffcfd6d76002755d6db53db827679, and it shipped in the upstream release the target is built on. generateFilePath() in src/helper/ssg/ssg.ts calls ensureWithinOutDir() on every output path before anything is written. The function is defined in src/helper/ssg/utils.ts and throws if the resolved path is o..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:49:46.782400+00:00", "status_notes": "Vulnerability CVE-2026-39409 does not affect version 4.12.27 of hono. not_affected \u2014 hono 4.12.27 already contains the upstream fix for CVE-2026-39409. The fix commit is 48fa2233 by Yusuke Wada (yusuke@kamawada.com), and it shipped in the upstream release before the first TuxCare commit. ipRestriction() now canonicalizes IPv4-mapped IPv6 client addresses and matches them against IPv4 static and CIDR rules.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39409" }, "impact_statement": "not_affected \u2014 hono 4.12.27 already contains the upstream fix for CVE-2026-39409. The fix commit is 48fa2233 by Yusuke Wada (yusuke@kamawada.com), and it shipped in the upstream release before the first TuxCare commit. ipRestriction() now canonicalizes IPv4-mapped IPv6 client addresses and matches them against IPv4 static and CIDR rules." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:52:00.137305+00:00", "status_notes": "Vulnerability CVE-2026-39410 does not affect version 4.12.27 of hono. not_affected \u2014 Target hono 4.12.27 already contains the upstream fix for CVE-2026-39410. parse() in src/utils/cookie.ts trims cookie names with trimCookieWhitespace(), which strips only SP (0x20) and HTAB (0x09), instead of String.prototype.trim(). A U+00A0-prefixed name therefore stays distinct, and it is also rejected by validCookieNameRegEx. The fix shipped in the upstream release, so this is an upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39410" }, "impact_statement": "not_affected \u2014 Target hono 4.12.27 already contains the upstream fix for CVE-2026-39410. parse() in src/utils/cookie.ts trims cookie names with trimCookieWhitespace(), which strips only SP (0x20) and HTAB (0x09), instead of String.prototype.trim(). A U+00A0-prefixed name therefore stays distinct, and it is also rejected by validCookieNameRegEx. The fix shipped in the upstream release, so this is an upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:48:00.051925+00:00", "status_notes": "Vulnerability CVE-2026-44455 does not affect version 4.12.27 of hono. not_affected \u2014 Hono 4.12.27 already contains the upstream fix for CVE-2026-44455. The fix is upstream commit 614b8345 (author taku@taaas.jp), and it shipped in the upstream release before the first TuxCare commit. JSXNode's constructor rejects invalid tag names, so unvalidated tag names can no longer reach the rendered HTML.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44455" }, "impact_statement": "not_affected \u2014 Hono 4.12.27 already contains the upstream fix for CVE-2026-44455. The fix is upstream commit 614b8345 (author taku@taaas.jp), and it shipped in the upstream release before the first TuxCare commit. JSXNode's constructor rejects invalid tag names, so unvalidated tag names can no longer reach the rendered HTML." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:48:18.808255+00:00", "status_notes": "Vulnerability CVE-2026-44456 does not affect version 4.12.27 of hono. not_affected \u2014 The target (hono 4.12.27) already contains the upstream fix for CVE-2026-44456. bodyLimit() now reads chunked or unknown-length bodies up-front and rejects oversized ones before next() runs. The fix commit db05b96 is the upstream fix, shipped in the upstream 4.12.27 release before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44456" }, "impact_statement": "not_affected \u2014 The target (hono 4.12.27) already contains the upstream fix for CVE-2026-44456. bodyLimit() now reads chunked or unknown-length bodies up-front and rejects oversized ones before next() runs. The fix commit db05b96 is the upstream fix, shipped in the upstream 4.12.27 release before the first TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:44:00.117801+00:00", "status_notes": "Vulnerability CVE-2026-44457 does not affect version 4.12.27 of hono. not_affected \u2014 Hono 4.12.27 already contains the upstream fix 568c2ecc, which is the patch URL given for this CVE. It was authored upstream by taku@taaas.jp and shipped in the 4.12.27 release (97c6fe1f). The Cache Middleware no longer stores a response that carries a Vary header, unless the Vary names are all covered by the middleware's own `vary` option. In that case they become part of the cache key. Reques...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44457" }, "impact_statement": "not_affected \u2014 Hono 4.12.27 already contains the upstream fix 568c2ecc, which is the patch URL given for this CVE. It was authored upstream by taku@taaas.jp and shipped in the 4.12.27 release (97c6fe1f). The Cache Middleware no longer stores a response that carries a Vary header, unless the Vary names are all covered by the middleware's own `vary` option. In that case they become part of the cache key. Reques..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:43:16.611537+00:00", "status_notes": "Vulnerability CVE-2026-44458 does not affect version 4.12.27 of hono. not_affected \u2014 The target (hono 4.12.27) already contains the upstream fix for CVE-2026-44458. The fix is commit 58d3d3ad, which is the GitHub commit named in the task and is an ancestor of HEAD. It shipped in the 4.12.27 upstream release, and no TuxCare-domain commits exist in HEAD's history. styleObjectForEach now drops style property names and values that could add CSS declarations. Both server-side JSX se...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44458" }, "impact_statement": "not_affected \u2014 The target (hono 4.12.27) already contains the upstream fix for CVE-2026-44458. The fix is commit 58d3d3ad, which is the GitHub commit named in the task and is an ancestor of HEAD. It shipped in the 4.12.27 upstream release, and no TuxCare-domain commits exist in HEAD's history. styleObjectForEach now drops style property names and values that could add CSS declarations. Both server-side JSX se..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:39:32.180152+00:00", "status_notes": "Vulnerability CVE-2026-44459 does not affect version 4.12.27 of hono. not_affected \u2014 Hono 4.12.27 already contains the upstream fix for CVE-2026-44459. verify() in src/utils/jwt/jwt.ts rejects exp, nbf and iat claims that are non-numeric or non-finite, and it no longer skips falsy values. The fix is upstream commit a5bd9ebe (author yusuke@kamawada.com). It shipped in the upstream release, and the history has no TuxCare-domain commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44459" }, "impact_statement": "not_affected \u2014 Hono 4.12.27 already contains the upstream fix for CVE-2026-44459. verify() in src/utils/jwt/jwt.ts rejects exp, nbf and iat claims that are non-numeric or non-finite, and it no longer skips falsy values. The fix is upstream commit a5bd9ebe (author yusuke@kamawada.com). It shipped in the upstream release, and the history has no TuxCare-domain commits." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:40:02.791007+00:00", "status_notes": "Vulnerability CVE-2026-47673 does not affect version 4.12.27 of hono. not_affected \u2014 Not affected. The jwt and jwk middlewares in hono 4.12.27 already reject any Authorization value whose scheme is not 'bearer' (case-insensitive). This is the upstream fix, commit 5463db27 by Taku Amano, and it was already part of the upstream 4.12.27 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47673" }, "impact_statement": "not_affected \u2014 Not affected. The jwt and jwk middlewares in hono 4.12.27 already reject any Authorization value whose scheme is not 'bearer' (case-insensitive). This is the upstream fix, commit 5463db27 by Taku Amano, and it was already part of the upstream 4.12.27 release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:41:53.414094+00:00", "status_notes": "Vulnerability CVE-2026-47674 does not affect version 4.12.27 of hono. not_affected \u2014 The upstream fix (hono commit c831020f, \"match static IP rules numerically\") is already in the 4.12.27 upstream release. ip-restriction now converts the remote address to a binary value and compares it numerically against static rule sets. Invalid addresses are rejected with a 403.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47674" }, "impact_statement": "not_affected \u2014 The upstream fix (hono commit c831020f, \"match static IP rules numerically\") is already in the 4.12.27 upstream release. ip-restriction now converts the remote address to a binary value and compares it numerically against static rule sets. Invalid addresses are rejected with a 403." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:39:32.180152+00:00", "status_notes": "Vulnerability CVE-2026-47675 does not affect version 4.12.27 of hono. not_affected \u2014 The target (hono 4.12.27) already contains the upstream fix. serialize() in src/utils/cookie.ts rejects ';', '\\r' and '\\n' in sameSite and priority as well as domain and path. The fix was authored upstream (commit 905aedbc, taku@taaas.jp) and is part of the upstream 4.12.27 release, so the pattern is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47675" }, "impact_statement": "not_affected \u2014 The target (hono 4.12.27) already contains the upstream fix. serialize() in src/utils/cookie.ts rejects ';', '\\r' and '\\n' in sameSite and priority as well as domain and path. The fix was authored upstream (commit 905aedbc, taku@taaas.jp) and is part of the upstream 4.12.27 release, so the pattern is not present." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:45:36.334046+00:00", "status_notes": "Vulnerability CVE-2026-47676 does not affect version 4.12.27 of hono. not_affected \u2014 The target (hono 4.12.27) already contains the upstream fix for CVE-2026-47676. Hono.mount() now strips the mount prefix from this.getPath(request), the same decoded-path representation that route matching uses. The fix is upstream commit 6cbb025ff by taku@taaas.jp, which is an ancestor of the upstream 4.12.27 release commit and predates the first TuxCare commit. This is an upstream fix, so the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47676" }, "impact_statement": "not_affected \u2014 The target (hono 4.12.27) already contains the upstream fix for CVE-2026-47676. Hono.mount() now strips the mount prefix from this.getPath(request), the same decoded-path representation that route matching uses. The fix is upstream commit 6cbb025ff by taku@taaas.jp, which is an ancestor of the upstream 4.12.27 release commit and predates the first TuxCare commit. This is an upstream fix, so the..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:41:00.162773+00:00", "status_notes": "Vulnerability CVE-2026-54286 does not affect version 4.12.27 of hono. not_affected \u2014 The target (hono 4.12.27) already contains the upstream fix. The serve-static guard in src/middleware/serve-static/index.ts:67 rejects any decoded path containing a backslash. The upstream commit 751ba41b added this, and it is an ancestor of HEAD and part of the upstream 4.12.27 release. No TuxCare-domain commit exists in HEAD's history.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54286" }, "impact_statement": "not_affected \u2014 The target (hono 4.12.27) already contains the upstream fix. The serve-static guard in src/middleware/serve-static/index.ts:67 rejects any decoded path containing a backslash. The upstream commit 751ba41b added this, and it is an ancestor of HEAD and part of the upstream 4.12.27 release. No TuxCare-domain commit exists in HEAD's history." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:45:02.967150+00:00", "status_notes": "Vulnerability CVE-2026-54287 does not affect version 4.12.27 of hono. not_affected \u2014 The upstream fix for CVE-2026-54287 (commit 7ae7cbae) is already in HEAD and shipped with the upstream 4.12.27 release. ALB single-header mode and VPC Lattice v2 no longer join Set-Cookie values with \", \". The ALB path now emits the first cookie only, and the Lattice path emits an array. The target has no TuxCare-authored commits, so this is an upstream fix and the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54287" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-54287 (commit 7ae7cbae) is already in HEAD and shipped with the upstream 4.12.27 release. ALB single-header mode and VPC Lattice v2 no longer join Set-Cookie values with \", \". The ALB path now emits the first cookie only, and the Lattice path emits an array. The target has no TuxCare-authored commits, so this is an upstream fix and the verdict is not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:41:00.162773+00:00", "status_notes": "Vulnerability CVE-2026-54288 does not affect version 4.12.27 of hono. not_affected \u2014 Target hono 4.12.27 already contains the upstream fix. The AWS Lambda and Lambda@Edge adapters overwrite the client-supplied content-length header with the actual decoded body byte length, so the body-limit middleware's trust in Content-Length is safe. The fix commits fa5f9bfc and e50df014 are upstream, authored by Yusuke Wada, and are ancestors of HEAD. HEAD's only TuxCare-side commits are bui...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54288" }, "impact_statement": "not_affected \u2014 Target hono 4.12.27 already contains the upstream fix. The AWS Lambda and Lambda@Edge adapters overwrite the client-supplied content-length header with the actual decoded body byte length, so the body-limit middleware's trust in Content-Length is safe. The fix commits fa5f9bfc and e50df014 are upstream, authored by Yusuke Wada, and are ancestors of HEAD. HEAD's only TuxCare-side commits are bui..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:45:36.334046+00:00", "status_notes": "Vulnerability CVE-2026-54289 does not affect version 4.12.27 of hono. not_affected \u2014 The Lambda@Edge adapter in this tree (hono 4.12.27) already uses Headers.append for every entry of a repeated header, so all values are preserved. The upstream fix commit 3892a6c2 is an ancestor of HEAD and is part of the upstream 4.12.27 release. It was authored by a non-TuxCare identity, so the verdict is not_affected rather than already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54289" }, "impact_statement": "not_affected \u2014 The Lambda@Edge adapter in this tree (hono 4.12.27) already uses Headers.append for every entry of a repeated header, so all values are preserved. The upstream fix commit 3892a6c2 is an ancestor of HEAD and is part of the upstream 4.12.27 release. It was authored by a non-TuxCare identity, so the verdict is not_affected rather than already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:45:02.967150+00:00", "status_notes": "Vulnerability CVE-2026-54290 does not affect version 4.12.27 of hono. not_affected \u2014 Hono 4.12.27 already contains the upstream fix. In src/middleware/cors/index.ts the wildcard origin returns the literal '*' and never reflects the request Origin, even with credentials: true. The upstream vendor fix (f0b094db, Yusuke Wada) removed the reflection branch. It ships in the upstream 4.12.27 release, before any TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54290" }, "impact_statement": "not_affected \u2014 Hono 4.12.27 already contains the upstream fix. In src/middleware/cors/index.ts the wildcard origin returns the literal '*' and never reflects the request Origin, even with credentials: true. The upstream vendor fix (f0b094db, Yusuke Wada) removed the reflection branch. It ships in the upstream 4.12.27 release, before any TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:49:46.782400+00:00", "status_notes": "Vulnerability CVE-2026-56761 does not affect version 4.12.27 of hono. not_affected \u2014 Hono 4.12.27 already contains the upstream fix for CVE-2026-56761 (commit 66daa2ed, \"validate attribute names to prevent XSS via key injection\"). The SSR renderer in base.ts and the jsxAttr helper in jsx-runtime.ts both call isValidAttributeName and skip any key containing whitespace, quotes, angle brackets, '/', '=', backtick, backslash or control characters. The fix shipped in the upstream re...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56761" }, "impact_statement": "not_affected \u2014 Hono 4.12.27 already contains the upstream fix for CVE-2026-56761 (commit 66daa2ed, \"validate attribute names to prevent XSS via key injection\"). The SSR renderer in base.ts and the jsxAttr helper in jsx-runtime.ts both call isValidAttributeName and skip any key containing whitespace, quotes, angle brackets, '/', '=', backtick, backslash or control characters. The fix shipped in the upstream re..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:54:29.457147+00:00", "status_notes": "Vulnerability CVE-2026-56762 does not affect version 4.12.27 of hono. not_affected \u2014 The upstream fix (a586cd72, \"Merge commit from fork\") is already in hono 4.12.27. `_serialize` in src/utils/cookie.ts rejects any cookie name that fails the RFC 6265 token regex, so `serialize`, `serializeSigned` and `setCookie` all throw 'Invalid cookie name' before a Set-Cookie value is built. The fix shipped in the upstream release, not as a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56762" }, "impact_statement": "not_affected \u2014 The upstream fix (a586cd72, \"Merge commit from fork\") is already in hono 4.12.27. `_serialize` in src/utils/cookie.ts rejects any cookie name that fails the RFC 6265 token regex, so `serialize`, `serializeSigned` and `setCookie` all throw 'Invalid cookie name' before a Set-Cookie value is built. The fix shipped in the upstream release, not as a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:55:00.037891+00:00", "status_notes": "Vulnerability CVE-2026-56763 does not affect version 4.12.27 of hono. not_affected \u2014 The upstream fix (ef902257, \"Merge commit from fork\") is already in HEAD. handleParsingNestedValues in src/utils/body.ts returns early for any dotted key containing a __proto__ segment. The fix shipped in the upstream 4.12.27 release, and HEAD has no TuxCare-domain commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56763" }, "impact_statement": "not_affected \u2014 The upstream fix (ef902257, \"Merge commit from fork\") is already in HEAD. handleParsingNestedValues in src/utils/body.ts returns early for any dotted key containing a __proto__ segment. The fix shipped in the upstream 4.12.27 release, and HEAD has no TuxCare-domain commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:41:53.414094+00:00", "status_notes": "Vulnerability CVE-2026-59895 does not affect version 4.12.27 of hono. not_affected \u2014 The target (hono 4.12.27) already contains the upstream fix for CVE-2026-59895. In src/helper/css/index.ts, newCssClassNameObject HTML-escapes the composed class name before marking it isEscaped, so a cx() class name containing a quote can no longer break out of the JSX class attribute. The fix is upstream commit cd3f6f71 (author taku@taaas.jp), which is an ancestor of HEAD and ships in the 4.1...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59895" }, "impact_statement": "not_affected \u2014 The target (hono 4.12.27) already contains the upstream fix for CVE-2026-59895. In src/helper/css/index.ts, newCssClassNameObject HTML-escapes the composed class name before marking it isEscaped, so a cx() class name containing a quote can no longer break out of the JSX class attribute. The fix is upstream commit cd3f6f71 (author taku@taaas.jp), which is an ancestor of HEAD and ships in the 4.1..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:42:44.671195+00:00", "status_notes": "Vulnerability CVE-2026-59896 does not affect version 4.12.27 of hono. not_affected \u2014 The upstream fix for CVE-2026-59896 is already in the shipped hono 4.12.27 release. hono/jsx now keeps context values in a per-render store held in AsyncLocalStorage, not in a process-wide array. All three fix commits are ancestors of HEAD and were authored upstream.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59896" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-59896 is already in the shipped hono 4.12.27 release. hono/jsx now keeps context values in a per-render store held in AsyncLocalStorage, not in a process-wide array. All three fix commits are ancestors of HEAD and were authored upstream." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:45:02.967150+00:00", "status_notes": "Vulnerability CVE-2026-59897 does not affect version 4.12.27 of hono. not_affected \u2014 The upstream Hono fix (aa921770, \"Merge commit from fork\") is already in the 4.12.27 target. The V1 and Lattice adapters no longer use the substring check `foundK.includes(sanitizedValue)` to de-duplicate repeated headers. They now append every multiValueHeaders value and only set event.headers entries when the header is not already present. The fix shipped in the upstream release and was not a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59897" }, "impact_statement": "not_affected \u2014 The upstream Hono fix (aa921770, \"Merge commit from fork\") is already in the 4.12.27 target. The V1 and Lattice adapters no longer use the substring check `foundK.includes(sanitizedValue)` to de-duplicate repeated headers. They now append every multiValueHeaders value and only set event.headers entries when the header is not already present. The fix shipped in the upstream release and was not a..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69207 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2026-69207" }, "action_statement": "Vulnerability CVE-2026-69207 affects version 4.12.27 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71848 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2026-71848" }, "action_statement": "Vulnerability CVE-2026-71848 affects version 4.12.27 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71849 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2026-71849" }, "action_statement": "Vulnerability CVE-2026-71849 affects version 4.12.27 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71850 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2026-71850" }, "action_statement": "Vulnerability CVE-2026-71850 affects version 4.12.27 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84363 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2026-84363" }, "action_statement": "Vulnerability CVE-2026-84363 affects version 4.12.27 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84364 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2026-84364" }, "action_statement": "Vulnerability CVE-2026-84364 affects version 4.12.27 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84365 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2026-84365" }, "action_statement": "Vulnerability CVE-2026-84365 affects version 4.12.27 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-09-30T23:54:00.098505+00:00", "status_notes": "Vulnerability CVE-2026-93981 affects version 4.12.27 of hono.", "vulnerability": { "name": "CVE-2026-93981" }, "action_statement": "Vulnerability CVE-2026-93981 affects version 4.12.27 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability GHSA-3wcj-gjvf-fvch is a false positive for hono 4.12.27.", "vulnerability": { "name": "GHSA-3wcj-gjvf-fvch" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability GHSA-55cm-p4ww-685g is a false positive for hono 4.12.27.", "vulnerability": { "name": "GHSA-55cm-p4ww-685g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-6623-4q32-82v8 is a false positive for hono 4.12.27.", "vulnerability": { "name": "GHSA-6623-4q32-82v8" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability GHSA-cw3j-28qq-x3xh is a false positive for hono 4.12.27.", "vulnerability": { "name": "GHSA-cw3j-28qq-x3xh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.27", "identifiers": { "purl": "pkg:npm/hono@4.12.27" } } ], "timestamp": "2026-11-13T19:52:00.137305+00:00", "status_notes": "Vulnerability GHSA-gq3j-xvxp-8hrf does not affect version 4.12.27 of hono. not_affected \u2014 Hono 4.12.27 already contains the upstream fix (commit 91def7cab, \"Merge commit from fork\"). timingSafeEqualString in src/utils/buffer.ts compares the hashes and the original strings with constantTimeEqualString, which has no early exit. The fix shipped in the upstream release, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-gq3j-xvxp-8hrf" }, "impact_statement": "not_affected \u2014 Hono 4.12.27 already contains the upstream fix (commit 91def7cab, \"Merge commit from fork\"). timingSafeEqualString in src/utils/buffer.ts compares the hashes and the original strings with constantTimeEqualString, which has no early exit. The fix shipped in the upstream release, so the target is not affected." } ] }