{ "@id": "urn:uuid:29a2f4f1-a0ab-4148-9038-2b545e30e9a9", "role": "Document Creator", "author": "https://tuxcare.com", "version": 33, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T19:55:26.538286+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2023-50710 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2023-50710" }, "action_statement": "Vulnerability CVE-2023-50710 affects version 4.12.31 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-32869 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2024-32869" }, "action_statement": "Vulnerability CVE-2024-32869 affects version 4.12.31 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-43787 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2024-43787" }, "action_statement": "Vulnerability CVE-2024-43787 affects version 4.12.31 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-48913 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2024-48913" }, "action_statement": "Vulnerability CVE-2024-48913 affects version 4.12.31 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-58362 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2025-58362" }, "action_statement": "Vulnerability CVE-2025-58362 affects version 4.12.31 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-59139 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2025-59139" }, "action_statement": "Vulnerability CVE-2025-59139 affects version 4.12.31 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-62610 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2025-62610" }, "action_statement": "Vulnerability CVE-2025-62610 affects version 4.12.31 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-10-29T20:31:24.273560+00:00", "status_notes": "Vulnerability CVE-2025-71381 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2025-71381" }, "action_statement": "Vulnerability CVE-2025-71381 affects version 4.12.31 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-10-20T14:41:00.226982+00:00", "status_notes": "Vulnerability CVE-2026-111757 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2026-111757" }, "action_statement": "Vulnerability CVE-2026-111757 affects version 4.12.31 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-12T23:39:00.066400+00:00", "status_notes": "Vulnerability CVE-2026-126355 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2026-126355" }, "action_statement": "Vulnerability CVE-2026-126355 affects version 4.12.31 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-12T23:39:00.066400+00:00", "status_notes": "Vulnerability CVE-2026-126356 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2026-126356" }, "action_statement": "Vulnerability CVE-2026-126356 affects version 4.12.31 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126357 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2026-126357" }, "action_statement": "Vulnerability CVE-2026-126357 affects version 4.12.31 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126358 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2026-126358" }, "action_statement": "Vulnerability CVE-2026-126358 affects version 4.12.31 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126359 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2026-126359" }, "action_statement": "Vulnerability CVE-2026-126359 affects version 4.12.31 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-22817 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2026-22817" }, "action_statement": "Vulnerability CVE-2026-22817 affects version 4.12.31 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-22818 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2026-22818" }, "action_statement": "Vulnerability CVE-2026-22818 affects version 4.12.31 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:51:00.041863+00:00", "status_notes": "Vulnerability CVE-2026-24398 does not affect version 4.12.31 of hono. not_affected \u2014 Not affected. The upstream fix (edbf6eea, Merge commit from fork) is already in the shipped hono 4.12.31 source. IPV4_REGEX now restricts each octet to 0-255, and convertIPv4ToBinary rejects any octet above 255 and any leading-zero octet. Addresses like 1.2.2.355 are therefore rejected rather than silently rewritten as 1.2.3.99.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24398" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix (edbf6eea, Merge commit from fork) is already in the shipped hono 4.12.31 source. IPV4_REGEX now restricts each octet to 0-255, and convertIPv4ToBinary rejects any octet above 255 and any leading-zero octet. Addresses like 1.2.2.355 are therefore rejected rather than silently rewritten as 1.2.3.99." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:47:35.365109+00:00", "status_notes": "Vulnerability CVE-2026-24472 does not affect version 4.12.31 of hono. not_affected \u2014 The upstream fix for CVE-2026-24472 (honojs/hono commit 12c51174, \"Merge commit from fork\") is already in the target (hono 4.12.31). The cache middleware skips caching responses whose Cache-Control contains private, no-store or no-cache. The fix commit is by an upstream author and is an ancestor of HEAD. No TuxCare-domain commit exists in the history, so this is an upstream fix shipped in the r...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24472" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-24472 (honojs/hono commit 12c51174, \"Merge commit from fork\") is already in the target (hono 4.12.31). The cache middleware skips caching responses whose Cache-Control contains private, no-store or no-cache. The fix commit is by an upstream author and is an ancestor of HEAD. No TuxCare-domain commit exists in the history, so this is an upstream fix shipped in the r..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:51:00.041863+00:00", "status_notes": "Vulnerability CVE-2026-24473 does not affect version 4.12.31 of hono. not_affected \u2014 The upstream fix for CVE-2026-24473 (hono commit cf9a78db) is already in HEAD. `getContentFromKVAsset` in the Cloudflare Workers adapter now uses `ASSET_MANIFEST[path]` with no `|| path` fallback, so an unmapped request path can no longer be used as a raw KV key. The fix was authored upstream by yusuke@kamawada.com and shipped in the upstream release. The target has no commit by a TuxCare-domai...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24473" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-24473 (hono commit cf9a78db) is already in HEAD. `getContentFromKVAsset` in the Cloudflare Workers adapter now uses `ASSET_MANIFEST[path]` with no `|| path` fallback, so an unmapped request path can no longer be used as a raw KV key. The fix was authored upstream by yusuke@kamawada.com and shipped in the upstream release. The target has no commit by a TuxCare-domai..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:48:18.808255+00:00", "status_notes": "Vulnerability CVE-2026-24771 does not affect version 4.12.31 of hono. not_affected \u2014 The upstream fix for CVE-2026-24771 (honojs/hono commit 2cf60046, \"Merge commit from fork\") is already in the 4.12.31 target. It is an ancestor of HEAD and of the first TuxCare commit (afdd3d96), so it shipped in the upstream release. src/jsx/components.ts no longer forces raw HTML on string children or fallbackRender output. The author (taku@taaas.jp) and committer (noreply@github.com) are bot...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24771" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-24771 (honojs/hono commit 2cf60046, \"Merge commit from fork\") is already in the 4.12.31 target. It is an ancestor of HEAD and of the first TuxCare commit (afdd3d96), so it shipped in the upstream release. src/jsx/components.ts no longer forces raw HTML on string children or fallbackRender output. The author (taku@taaas.jp) and committer (noreply@github.com) are bot..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-27700 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2026-27700" }, "action_statement": "Vulnerability CVE-2026-27700 affects version 4.12.31 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:47:00.039124+00:00", "status_notes": "Vulnerability CVE-2026-29045 does not affect version 4.12.31 of hono. not_affected \u2014 The upstream fix (hono commit 6a0607a9, which replaces decodeURIComponent with tryDecodeURI in serveStatic) is already in the target, hono 4.12.31. serveStatic decodes with decodeURI semantics, the same as the router, so %2F is not turned into '/'. The fix came with the upstream release, not from a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29045" }, "impact_statement": "not_affected \u2014 The upstream fix (hono commit 6a0607a9, which replaces decodeURIComponent with tryDecodeURI in serveStatic) is already in the target, hono 4.12.31. serveStatic decodes with decodeURI semantics, the same as the router, so %2F is not turned into '/'. The fix came with the upstream release, not from a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:51:08.867324+00:00", "status_notes": "Vulnerability CVE-2026-29085 does not affect version 4.12.31 of hono. not_affected \u2014 The target is hono 4.12.31, and writeSSE in src/helper/streaming/sse.ts already rejects CR/LF in `event` and `id`. This comes from the upstream fix commit f4123ed9, which is part of the upstream release TuxCare onboarded. A later upstream commit (aeba9ece) dropped `retry` from the check because `retry` is typed as a number. So this is an upstream fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29085" }, "impact_statement": "not_affected \u2014 The target is hono 4.12.31, and writeSSE in src/helper/streaming/sse.ts already rejects CR/LF in `event` and `id`. This comes from the upstream fix commit f4123ed9, which is part of the upstream release TuxCare onboarded. A later upstream commit (aeba9ece) dropped `retry` from the check because `retry` is typed as a number. So this is an upstream fix, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:49:46.782400+00:00", "status_notes": "Vulnerability CVE-2026-29086 does not affect version 4.12.31 of hono. not_affected \u2014 Hono 4.12.31 already contains the upstream fix for CVE-2026-29086. `_serialize()` in src/utils/cookie.ts rejects `;`, `\\r` and `\\n` in `domain`, `path`, `sameSite` and `priority` before building the Set-Cookie header. The fix is upstream commit 44ae0c8c, authored by taku@taaas.jp and committed by noreply@github.com. It is shipped in the upstream release and is an ancestor of HEAD.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29086" }, "impact_statement": "not_affected \u2014 Hono 4.12.31 already contains the upstream fix for CVE-2026-29086. `_serialize()` in src/utils/cookie.ts rejects `;`, `\\r` and `\\n` in `domain`, `path`, `sameSite` and `priority` before building the Set-Cookie header. The fix is upstream commit 44ae0c8c, authored by taku@taaas.jp and committed by noreply@github.com. It is shipped in the upstream release and is an ancestor of HEAD." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:47:11.992608+00:00", "status_notes": "Vulnerability CVE-2026-39407 does not affect version 4.12.31 of hono. not_affected \u2014 The upstream fix for CVE-2026-39407 (honojs/hono 9aff14bd) is already present in the target. serveStatic in src/middleware/serve-static/index.ts rejects request paths with repeated slashes or backslashes before resolving a file. The fix commit is authored by upstream (taku@taaas.jp) and was already in the upstream release that TuxCare onboarded, so the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39407" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-39407 (honojs/hono 9aff14bd) is already present in the target. serveStatic in src/middleware/serve-static/index.ts rejects request paths with repeated slashes or backslashes before resolving a file. The fix commit is authored by upstream (taku@taaas.jp) and was already in the upstream release that TuxCare onboarded, so the verdict is not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:45:49.219313+00:00", "status_notes": "Vulnerability CVE-2026-39408 does not affect version 4.12.31 of hono. not_affected \u2014 Not affected. The upstream fix (hono commit b470278920, \"Merge commit from fork\") is already in HEAD, shipped in the upstream 4.12.31 release. generateFilePath() calls ensureWithinOutDir(), which throws if the resolved output path escapes the output directory.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39408" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix (hono commit b470278920, \"Merge commit from fork\") is already in HEAD, shipped in the upstream 4.12.31 release. generateFilePath() calls ensureWithinOutDir(), which throws if the resolved output path escapes the output directory." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:49:00.036571+00:00", "status_notes": "Vulnerability CVE-2026-39409 does not affect version 4.12.31 of hono. not_affected \u2014 hono 4.12.31 already contains the upstream fix for CVE-2026-39409. The ipRestriction middleware canonicalizes IPv4-mapped IPv6 client addresses so IPv4 static and CIDR rules match them. The fix commit 48fa2233 is an upstream commit and is in the 4.12.31 release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39409" }, "impact_statement": "not_affected \u2014 hono 4.12.31 already contains the upstream fix for CVE-2026-39409. The ipRestriction middleware canonicalizes IPv4-mapped IPv6 client addresses so IPv4 static and CIDR rules match them. The fix commit 48fa2233 is an upstream commit and is in the 4.12.31 release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:52:09.538868+00:00", "status_notes": "Vulnerability CVE-2026-39410 does not affect version 4.12.31 of hono. not_affected \u2014 The target (hono 4.12.31) already contains the upstream fix for CVE-2026-39410. parse() in src/utils/cookie.ts trims only SP and HTAB, so a U+00A0-prefixed cookie name is no longer folded onto the legitimate name. The fix commit cc067c85 is upstream work by taku@taaas.jp and shipped in the upstream release, not as a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39410" }, "impact_statement": "not_affected \u2014 The target (hono 4.12.31) already contains the upstream fix for CVE-2026-39410. parse() in src/utils/cookie.ts trims only SP and HTAB, so a U+00A0-prefixed cookie name is no longer folded onto the legitimate name. The fix commit cc067c85 is upstream work by taku@taaas.jp and shipped in the upstream release, not as a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:48:00.051925+00:00", "status_notes": "Vulnerability CVE-2026-44455 does not affect version 4.12.31 of hono. not_affected \u2014 Target hono 4.12.31 already contains the upstream fix (commit 614b8345, Taku Amano). JSXNode's constructor now rejects invalid tag names via isValidTagName, so untrusted tag names cannot reach the HTML emitter. The fix shipped in the upstream release, before any TuxCare commit, so the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44455" }, "impact_statement": "not_affected \u2014 Target hono 4.12.31 already contains the upstream fix (commit 614b8345, Taku Amano). JSXNode's constructor now rejects invalid tag names via isValidTagName, so untrusted tag names cannot reach the HTML emitter. The fix shipped in the upstream release, before any TuxCare commit, so the verdict is not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:49:00.036571+00:00", "status_notes": "Vulnerability CVE-2026-44456 does not affect version 4.12.31 of hono. not_affected \u2014 The target is hono 4.12.31. It already contains the upstream fix commit db05b96d (Yusuke Wada), which is an ancestor of HEAD. bodyLimit() now reads chunked or unknown-length bodies to completion before calling next(). It returns onError as soon as the running size exceeds maxSize. It then replays the buffered chunks as a new Request. Handlers therefore cannot return 200 for an oversized chunked...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44456" }, "impact_statement": "not_affected \u2014 The target is hono 4.12.31. It already contains the upstream fix commit db05b96d (Yusuke Wada), which is an ancestor of HEAD. bodyLimit() now reads chunked or unknown-length bodies to completion before calling next(). It returns onError as soon as the running size exceeds maxSize. It then replays the buffered chunks as a new Request. Handlers therefore cannot return 200 for an oversized chunked..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:44:00.117801+00:00", "status_notes": "Vulnerability CVE-2026-44457 does not affect version 4.12.31 of hono. not_affected \u2014 Hono 4.12.31 already contains the upstream fix for CVE-2026-44457 (honojs/hono 568c2ecc, authored by Taku Amano). Responses with a Vary header not covered by the configured vary option are not cached, and requests carrying Authorization bypass the cache. The fix shipped in the upstream 4.12.31 release, which predates the first TuxCare commit, so this is an upstream fix and not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44457" }, "impact_statement": "not_affected \u2014 Hono 4.12.31 already contains the upstream fix for CVE-2026-44457 (honojs/hono 568c2ecc, authored by Taku Amano). Responses with a Vary header not covered by the configured vary option are not cached, and requests carrying Authorization bypass the cache. The fix shipped in the upstream 4.12.31 release, which predates the first TuxCare commit, so this is an upstream fix and not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:43:00.058870+00:00", "status_notes": "Vulnerability CVE-2026-44458 does not affect version 4.12.31 of hono. not_affected \u2014 Not affected. The upstream fix for CVE-2026-44458 (honojs/hono commit 58d3d3ad) is already in this tree, which is hono 4.12.31. `styleObjectForEach` in src/jsx/utils.ts now validates style property names and rejects unsafe style values, so the server-side JSX renderer no longer passes injected CSS declarations through.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44458" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2026-44458 (honojs/hono commit 58d3d3ad) is already in this tree, which is hono 4.12.31. `styleObjectForEach` in src/jsx/utils.ts now validates style property names and rejects unsafe style values, so the server-side JSX renderer no longer passes injected CSS declarations through." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:39:54.275085+00:00", "status_notes": "Vulnerability CVE-2026-44459 does not affect version 4.12.31 of hono. not_affected \u2014 Target hono 4.12.31 already contains the upstream fix for CVE-2026-44459 (commit a5bd9ebe, authored by Yusuke Wada, non-TuxCare). verify() in src/utils/jwt/jwt.ts now rejects any nbf/exp/iat claim that is not a finite number. The fix shipped in the upstream release: the first TuxCare commit (afdd3d96) is a descendant of the fix commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44459" }, "impact_statement": "not_affected \u2014 Target hono 4.12.31 already contains the upstream fix for CVE-2026-44459 (commit a5bd9ebe, authored by Yusuke Wada, non-TuxCare). verify() in src/utils/jwt/jwt.ts now rejects any nbf/exp/iat claim that is not a finite number. The fix shipped in the upstream release: the first TuxCare commit (afdd3d96) is a descendant of the fix commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:41:00.162773+00:00", "status_notes": "Vulnerability CVE-2026-47673 does not affect version 4.12.31 of hono. not_affected \u2014 The jwt and jwk middlewares in the target (hono 4.12.31) already reject any Authorization-style header whose first token is not 'bearer' (case-insensitive). This is the upstream fix, commit 5463db27 (author taku@taaas.jp). It is in HEAD and was already present in the upstream release that TuxCare onboarded, so the vulnerable pattern is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47673" }, "impact_statement": "not_affected \u2014 The jwt and jwk middlewares in the target (hono 4.12.31) already reject any Authorization-style header whose first token is not 'bearer' (case-insensitive). This is the upstream fix, commit 5463db27 (author taku@taaas.jp). It is in HEAD and was already present in the upstream release that TuxCare onboarded, so the vulnerable pattern is absent." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:41:53.414094+00:00", "status_notes": "Vulnerability CVE-2026-47674 does not affect version 4.12.31 of hono. not_affected \u2014 The target (hono 4.12.31) already contains the upstream fix c831020fb1fa2e929d222f6c84e1abfe013e512b (\"Merge commit from fork\"). Static IP rules are matched numerically and invalid addresses are rejected. The fix was authored by taku@taaas.jp and shipped in the upstream 4.12.31 release, before the first TuxCare-era commit (afdd3d96). The patch itself was only supplied as a URL, so this was veri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47674" }, "impact_statement": "not_affected \u2014 The target (hono 4.12.31) already contains the upstream fix c831020fb1fa2e929d222f6c84e1abfe013e512b (\"Merge commit from fork\"). Static IP rules are matched numerically and invalid addresses are rejected. The fix was authored by taku@taaas.jp and shipped in the upstream 4.12.31 release, before the first TuxCare-era commit (afdd3d96). The patch itself was only supplied as a URL, so this was veri..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:39:54.275085+00:00", "status_notes": "Vulnerability CVE-2026-47675 does not affect version 4.12.31 of hono. not_affected \u2014 The target (hono 4.12.31) already contains the upstream fix. src/utils/cookie.ts:194-198 applies the /[;\\r\\n]/ check to domain, path, sameSite and priority, so injection through sameSite or priority is rejected. The fix commit 905aedbc is the upstream commit (author taku@taaas.jp, committed via GitHub). It is an ancestor of the first non-upstream commit, so it shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47675" }, "impact_statement": "not_affected \u2014 The target (hono 4.12.31) already contains the upstream fix. src/utils/cookie.ts:194-198 applies the /[;\\r\\n]/ check to domain, path, sameSite and priority, so injection through sameSite or priority is rejected. The fix commit 905aedbc is the upstream commit (author taku@taaas.jp, committed via GitHub). It is an ancestor of the first non-upstream commit, so it shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:45:49.219313+00:00", "status_notes": "Vulnerability CVE-2026-47676 does not affect version 4.12.31 of hono. not_affected \u2014 Hono 4.12.31 already contains the upstream fix for CVE-2026-47676. mount() slices the decoded path from this.getPath(request), the same representation as the prefix. The upstream commit 6cbb025f made this change and is an ancestor of HEAD.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47676" }, "impact_statement": "not_affected \u2014 Hono 4.12.31 already contains the upstream fix for CVE-2026-47676. mount() slices the decoded path from this.getPath(request), the same representation as the prefix. The upstream commit 6cbb025f made this change and is an ancestor of HEAD." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:41:53.414094+00:00", "status_notes": "Vulnerability CVE-2026-54286 does not affect version 4.12.31 of hono. not_affected \u2014 Hono 4.12.31 already contains the upstream fix for CVE-2026-54286. The serve-static guard (src/middleware/serve-static/index.ts:67) rejects any decoded path containing a backslash, so `/admin%5Csecret.txt` falls through to onNotFound/next() and never reaches the file resolver. The fix is upstream commit 751ba41b (author yusuke@kamawada.com). It predates the first TuxCare commit afdd3d96, so it ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54286" }, "impact_statement": "not_affected \u2014 Hono 4.12.31 already contains the upstream fix for CVE-2026-54286. The serve-static guard (src/middleware/serve-static/index.ts:67) rejects any decoded path containing a backslash, so `/admin%5Csecret.txt` falls through to onNotFound/next() and never reaches the file resolver. The fix is upstream commit 751ba41b (author yusuke@kamawada.com). It predates the first TuxCare commit afdd3d96, so it ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:44:22.172481+00:00", "status_notes": "Vulnerability CVE-2026-54287 does not affect version 4.12.31 of hono. not_affected \u2014 The upstream fix for CVE-2026-54287 (commit 7ae7cbae, \"preserve multiple Set-Cookie headers instead of joining with `, `\") is already in HEAD (hono 4.12.31). ALBProcessor.setCookiesToResult now emits cookies[0] intact in single-header mode. LatticeV2Processor.setCookiesToResult emits the cookies as an array. The `cookies.join(', ')` pattern is gone. The fix is upstream-authored and shipped in t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54287" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-54287 (commit 7ae7cbae, \"preserve multiple Set-Cookie headers instead of joining with `, `\") is already in HEAD (hono 4.12.31). ALBProcessor.setCookiesToResult now emits cookies[0] intact in single-header mode. LatticeV2Processor.setCookiesToResult emits the cookies as an array. The `cookies.join(', ')` pattern is gone. The fix is upstream-authored and shipped in t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:41:00.162773+00:00", "status_notes": "Vulnerability CVE-2026-54288 does not affect version 4.12.31 of hono. not_affected \u2014 Target hono 4.12.31 already contains the upstream fix (fa5f9bfc, e50df014). Both Lambda adapters overwrite the client-supplied content-length header with the actual decoded body byte length, so the body-limit middleware's Content-Length check reflects the real size. The fix is authored by upstream (yusuke@kamawada.com) and ships in the upstream release; no TuxCare-domain commit exists in HEAD h...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54288" }, "impact_statement": "not_affected \u2014 Target hono 4.12.31 already contains the upstream fix (fa5f9bfc, e50df014). Both Lambda adapters overwrite the client-supplied content-length header with the actual decoded body byte length, so the body-limit middleware's Content-Length check reflects the real size. The fix is authored by upstream (yusuke@kamawada.com) and ships in the upstream release; no TuxCare-domain commit exists in HEAD h..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:45:36.334046+00:00", "status_notes": "Vulnerability CVE-2026-54289 does not affect version 4.12.31 of hono. not_affected \u2014 Not affected. The Lambda@Edge adapter's createRequest (src/adapter/lambda-edge/handler.ts:172-175) already uses Headers.append for every entry of a repeated header. This upstream fix, commit 3892a6c2 (\"Merge commit from fork\"), shipped in the upstream 4.12.31 release that this target is based on.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54289" }, "impact_statement": "not_affected \u2014 Not affected. The Lambda@Edge adapter's createRequest (src/adapter/lambda-edge/handler.ts:172-175) already uses Headers.append for every entry of a repeated header. This upstream fix, commit 3892a6c2 (\"Merge commit from fork\"), shipped in the upstream 4.12.31 release that this target is based on." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:44:22.172481+00:00", "status_notes": "Vulnerability CVE-2026-54290 does not affect version 4.12.31 of hono. not_affected \u2014 Hono 4.12.31 already contains the upstream fix (commit f0b094db, \"Merge commit from fork\"). The credentials-plus-wildcard origin-reflection branch is removed from src/middleware/cors/index.ts, so the wildcard origin returns the literal '*' even with credentials: true. Browsers reject that combination, so the setup fails closed. The fix is upstream-authored and shipped in the release, so the ver...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54290" }, "impact_statement": "not_affected \u2014 Hono 4.12.31 already contains the upstream fix (commit f0b094db, \"Merge commit from fork\"). The credentials-plus-wildcard origin-reflection branch is removed from src/middleware/cors/index.ts, so the wildcard origin returns the literal '*' even with credentials: true. Browsers reject that combination, so the setup fails closed. The fix is upstream-authored and shipped in the release, so the ver..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:49:46.782400+00:00", "status_notes": "Vulnerability CVE-2026-56761 does not affect version 4.12.31 of hono. not_affected \u2014 Target hono 4.12.31 already contains the upstream fix (commit 66daa2ed, \"Merge commit from fork\") that validates JSX attribute names before output in both SSR render paths. The fix shipped in the upstream release, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56761" }, "impact_statement": "not_affected \u2014 Target hono 4.12.31 already contains the upstream fix (commit 66daa2ed, \"Merge commit from fork\") that validates JSX attribute names before output in both SSR render paths. The fix shipped in the upstream release, so the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:54:29.457147+00:00", "status_notes": "Vulnerability CVE-2026-56762 does not affect version 4.12.31 of hono. not_affected \u2014 The upstream fix for CVE-2026-56762 (hono commit a586cd72, adding cookie-name validation on the write path) is already in the target (hono 4.12.31). _serialize() in src/utils/cookie.ts rejects names that fail the RFC 6265 token regex, so serialize(), serializeSigned() and setCookie() all throw on an invalid name. The fix shipped in the upstream release, so the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56762" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-56762 (hono commit a586cd72, adding cookie-name validation on the write path) is already in the target (hono 4.12.31). _serialize() in src/utils/cookie.ts rejects names that fail the RFC 6265 token regex, so serialize(), serializeSigned() and setCookie() all throw on an invalid name. The fix shipped in the upstream release, so the verdict is not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:55:26.538286+00:00", "status_notes": "Vulnerability CVE-2026-56763 does not affect version 4.12.31 of hono. not_affected \u2014 Hono 4.12.31 already contains the upstream fix for CVE-2026-56763. handleParsingNestedValues in src/utils/body.ts returns early for any dot-notation key containing a `__proto__.` segment, so `parseBody({dot:true})` cannot build nested objects holding a `__proto__` property. The fix, upstream commit ef902257 (author taku@taaas.jp), is in the upstream 4.12.31 release that TuxCare onboarded. It is...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56763" }, "impact_statement": "not_affected \u2014 Hono 4.12.31 already contains the upstream fix for CVE-2026-56763. handleParsingNestedValues in src/utils/body.ts returns early for any dot-notation key containing a `__proto__.` segment, so `parseBody({dot:true})` cannot build nested objects holding a `__proto__` property. The fix, upstream commit ef902257 (author taku@taaas.jp), is in the upstream 4.12.31 release that TuxCare onboarded. It is..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:42:06.433226+00:00", "status_notes": "Vulnerability CVE-2026-59895 does not affect version 4.12.31 of hono. not_affected \u2014 The upstream hono fix for CVE-2026-59895 (commit cd3f6f71, \"fix(css): escape class names when rendering\" plus \"reject unsafe characters in external class names\") is already in HEAD (4.12.31). The commit shipped in the upstream release before the first TuxCare commit. cx() output is now HTML-escaped before it is marked isEscaped, and cxCommon drops class names with unsafe selector characters.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59895" }, "impact_statement": "not_affected \u2014 The upstream hono fix for CVE-2026-59895 (commit cd3f6f71, \"fix(css): escape class names when rendering\" plus \"reject unsafe characters in external class names\") is already in HEAD (4.12.31). The commit shipped in the upstream release before the first TuxCare commit. cx() output is now HTML-escaped before it is marked isEscaped, and cxCommon drops class names with unsafe selector characters." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:42:44.671195+00:00", "status_notes": "Vulnerability CVE-2026-59896 does not affect version 4.12.31 of hono. not_affected \u2014 The upstream fix for CVE-2026-59896 (commits fab3b136, 6735fea7, d4853a8f) is already in the 4.12.31 release this target ships. Render context is isolated per request through a per-render store backed by AsyncLocalStorage. The fix author (taku@taaas.jp) is not a TuxCare identity, and the fix predates the first TuxCare commit, so this is an upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59896" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-59896 (commits fab3b136, 6735fea7, d4853a8f) is already in the 4.12.31 release this target ships. Render context is isolated per request through a per-render store backed by AsyncLocalStorage. The fix author (taku@taaas.jp) is not a TuxCare identity, and the fix predates the first TuxCare commit, so this is an upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:45:02.967150+00:00", "status_notes": "Vulnerability CVE-2026-59897 does not affect version 4.12.31 of hono. not_affected \u2014 Not affected. The substring-based de-duplication of repeated header values (foundK.includes(sanitizedValue)) is gone from the V1 and Lattice V2 processors in src/adapter/aws-lambda/handler.ts. The upstream fix aa921770 (Yusuke Wada, committed via GitHub) is an ancestor of HEAD and was shipped in the upstream hono 4.12.x release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59897" }, "impact_statement": "not_affected \u2014 Not affected. The substring-based de-duplication of repeated header values (foundK.includes(sanitizedValue)) is gone from the V1 and Lattice V2 processors in src/adapter/aws-lambda/handler.ts. The upstream fix aa921770 (Yusuke Wada, committed via GitHub) is an ancestor of HEAD and was shipped in the upstream hono 4.12.x release that TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69207 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2026-69207" }, "action_statement": "Vulnerability CVE-2026-69207 affects version 4.12.31 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71848 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2026-71848" }, "action_statement": "Vulnerability CVE-2026-71848 affects version 4.12.31 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71849 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2026-71849" }, "action_statement": "Vulnerability CVE-2026-71849 affects version 4.12.31 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71850 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2026-71850" }, "action_statement": "Vulnerability CVE-2026-71850 affects version 4.12.31 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84363 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2026-84363" }, "action_statement": "Vulnerability CVE-2026-84363 affects version 4.12.31 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84364 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2026-84364" }, "action_statement": "Vulnerability CVE-2026-84364 affects version 4.12.31 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84365 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2026-84365" }, "action_statement": "Vulnerability CVE-2026-84365 affects version 4.12.31 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-09-30T23:54:00.098505+00:00", "status_notes": "Vulnerability CVE-2026-93981 affects version 4.12.31 of hono.", "vulnerability": { "name": "CVE-2026-93981" }, "action_statement": "Vulnerability CVE-2026-93981 affects version 4.12.31 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability GHSA-3wcj-gjvf-fvch is a false positive for hono 4.12.31.", "vulnerability": { "name": "GHSA-3wcj-gjvf-fvch" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability GHSA-55cm-p4ww-685g is a false positive for hono 4.12.31.", "vulnerability": { "name": "GHSA-55cm-p4ww-685g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-6623-4q32-82v8 is a false positive for hono 4.12.31.", "vulnerability": { "name": "GHSA-6623-4q32-82v8" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability GHSA-cw3j-28qq-x3xh is a false positive for hono 4.12.31.", "vulnerability": { "name": "GHSA-cw3j-28qq-x3xh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.31", "identifiers": { "purl": "pkg:npm/hono@4.12.31" } } ], "timestamp": "2026-11-13T19:51:24.435252+00:00", "status_notes": "Vulnerability GHSA-gq3j-xvxp-8hrf does not affect version 4.12.31 of hono. not_affected \u2014 hono 4.12.31 already contains the upstream fix (91def7ca, \"Merge commit from fork\"). timingSafeEqual in src/utils/buffer.ts no longer compares hashes with ===. It uses constantTimeEqualString, which scans the full length with no early exit. basicAuth and bearerAuth both call it. The fix shipped in the upstream release, so this is an upstream fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-gq3j-xvxp-8hrf" }, "impact_statement": "not_affected \u2014 hono 4.12.31 already contains the upstream fix (91def7ca, \"Merge commit from fork\"). timingSafeEqual in src/utils/buffer.ts no longer compares hashes with ===. It uses constantTimeEqualString, which scans the full length with no early exit. basicAuth and bearerAuth both call it. The fix shipped in the upstream release, so this is an upstream fix, not a TuxCare backport." } ] }