{ "@id": "urn:uuid:a96af0d1-3c94-4bbc-8a97-1098bcb377a5", "role": "Document Creator", "author": "https://tuxcare.com", "version": 20, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T19:55:00.037891+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2023-50710 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2023-50710" }, "action_statement": "Vulnerability CVE-2023-50710 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-32869 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2024-32869" }, "action_statement": "Vulnerability CVE-2024-32869 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-43787 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2024-43787" }, "action_statement": "Vulnerability CVE-2024-43787 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-48913 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2024-48913" }, "action_statement": "Vulnerability CVE-2024-48913 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-58362 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2025-58362" }, "action_statement": "Vulnerability CVE-2025-58362 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-59139 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2025-59139" }, "action_statement": "Vulnerability CVE-2025-59139 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-62610 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2025-62610" }, "action_statement": "Vulnerability CVE-2025-62610 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-10-29T20:31:24.273560+00:00", "status_notes": "Vulnerability CVE-2025-71381 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2025-71381" }, "action_statement": "Vulnerability CVE-2025-71381 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-10-20T14:41:00.226982+00:00", "status_notes": "Vulnerability CVE-2026-111757 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-111757" }, "action_statement": "Vulnerability CVE-2026-111757 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-12T23:39:00.066400+00:00", "status_notes": "Vulnerability CVE-2026-126355 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-126355" }, "action_statement": "Vulnerability CVE-2026-126355 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-12T23:39:00.066400+00:00", "status_notes": "Vulnerability CVE-2026-126356 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-126356" }, "action_statement": "Vulnerability CVE-2026-126356 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126357 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-126357" }, "action_statement": "Vulnerability CVE-2026-126357 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126358 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-126358" }, "action_statement": "Vulnerability CVE-2026-126358 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126359 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-126359" }, "action_statement": "Vulnerability CVE-2026-126359 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-22817 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-22817" }, "action_statement": "Vulnerability CVE-2026-22817 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-22818 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-22818" }, "action_statement": "Vulnerability CVE-2026-22818 affects version 4.12.7 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-13T19:51:00.041863+00:00", "status_notes": "Vulnerability CVE-2026-24398 does not affect version 4.12.7 of hono. not_affected \u2014 Not affected. The upstream fix, commit edbf6eea (author yusuke@kamawada.com, committer noreply@github.com), is an ancestor of HEAD and shipped in the upstream hono 4.12.7 release. IPV4_REGEX now restricts each octet to 0-255, so out-of-range addresses like 1.2.2.355 are rejected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24398" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix, commit edbf6eea (author yusuke@kamawada.com, committer noreply@github.com), is an ancestor of HEAD and shipped in the upstream hono 4.12.7 release. IPV4_REGEX now restricts each octet to 0-255, so out-of-range addresses like 1.2.2.355 are rejected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-13T19:47:35.365109+00:00", "status_notes": "Vulnerability CVE-2026-24472 does not affect version 4.12.7 of hono. not_affected \u2014 Hono 4.12.7 already contains the upstream fix for CVE-2026-24472. The cache middleware's shouldSkipCache() refuses to store responses with Cache-Control private, no-store or no-cache, as well as Vary: * and Set-Cookie. The fix is upstream commit 12c511745b, authored by simon@koeck.dev and committed by noreply@github.com. It is an ancestor of the first TuxCare commit, so it shipped in the upstre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24472" }, "impact_statement": "not_affected \u2014 Hono 4.12.7 already contains the upstream fix for CVE-2026-24472. The cache middleware's shouldSkipCache() refuses to store responses with Cache-Control private, no-store or no-cache, as well as Vary: * and Set-Cookie. The fix is upstream commit 12c511745b, authored by simon@koeck.dev and committed by noreply@github.com. It is an ancestor of the first TuxCare commit, so it shipped in the upstre..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-13T19:51:08.867324+00:00", "status_notes": "Vulnerability CVE-2026-24473 does not affect version 4.12.7 of hono. not_affected \u2014 The upstream fix for CVE-2026-24473 (hono commit cf9a78db) is already in this tree. getContentFromKVAsset no longer falls back to the raw request path when the manifest has no entry, so a user-supplied path can no longer read an arbitrary key from the KV namespace. The fix was authored upstream and is not TuxCare-attributed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24473" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-24473 (hono commit cf9a78db) is already in this tree. getContentFromKVAsset no longer falls back to the raw request path when the manifest has no entry, so a user-supplied path can no longer read an arbitrary key from the KV namespace. The fix was authored upstream and is not TuxCare-attributed." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-13T19:48:18.808255+00:00", "status_notes": "Vulnerability CVE-2026-24771 does not affect version 4.12.7 of hono. not_affected \u2014 Target hono 4.12.7 already contains the upstream fix for CVE-2026-24771 (upstream commit 2cf60046, merged GHSA fix). ErrorBoundary in src/jsx/components.ts no longer forces children/fallback strings into raw HTML; plain strings are passed through Fragment/jsx so default escaping applies.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24771" }, "impact_statement": "not_affected \u2014 Target hono 4.12.7 already contains the upstream fix for CVE-2026-24771 (upstream commit 2cf60046, merged GHSA fix). ErrorBoundary in src/jsx/components.ts no longer forces children/fallback strings into raw HTML; plain strings are passed through Fragment/jsx so default escaping applies." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-27700 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-27700" }, "action_statement": "Vulnerability CVE-2026-27700 affects version 4.12.7 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-13T19:46:17.356729+00:00", "status_notes": "Vulnerability CVE-2026-29045 does not affect version 4.12.7 of hono. not_affected \u2014 The target (hono 4.12.7) already contains the upstream fix 6a0607a9 (\"Merge commit from fork\"). serveStatic decodes the request path with tryDecodeURI (decodeURI), the same decoding the router's getPath uses. The router and the static handler therefore see the same path, so an encoded slash (%2F) stays encoded in both and the route-middleware bypass is not possible. The fix was authored upstrea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29045" }, "impact_statement": "not_affected \u2014 The target (hono 4.12.7) already contains the upstream fix 6a0607a9 (\"Merge commit from fork\"). serveStatic decodes the request path with tryDecodeURI (decodeURI), the same decoding the router's getPath uses. The router and the static handler therefore see the same path, so an encoded slash (%2F) stays encoded in both and the route-middleware bypass is not possible. The fix was authored upstrea..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-13T19:51:00.041863+00:00", "status_notes": "Vulnerability CVE-2026-29085 does not affect version 4.12.7 of hono. not_affected \u2014 hono 4.12.7 already contains the upstream CR/LF validation for the SSE event, id and retry fields. The fix is upstream commit f4123ed9 (author taku@taaas.jp), which is in the upstream 4.12.7 release, before any TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29085" }, "impact_statement": "not_affected \u2014 hono 4.12.7 already contains the upstream CR/LF validation for the SSE event, id and retry fields. The fix is upstream commit f4123ed9 (author taku@taaas.jp), which is in the upstream 4.12.7 release, before any TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-13T19:50:04.403996+00:00", "status_notes": "Vulnerability CVE-2026-29086 does not affect version 4.12.7 of hono. not_affected \u2014 Hono 4.12.7 already contains the upstream fix for CVE-2026-29086. _serialize() in src/utils/cookie.ts rejects ';', '\\r' and '\\n' in the domain and path options before building the Set-Cookie header. The fix commit is upstream commit 44ae0c8c, which is in the 4.12.7 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29086" }, "impact_statement": "not_affected \u2014 Hono 4.12.7 already contains the upstream fix for CVE-2026-29086. _serialize() in src/utils/cookie.ts rejects ';', '\\r' and '\\n' in the domain and path options before building the Set-Cookie header. The fix commit is upstream commit 44ae0c8c, which is in the 4.12.7 release that TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39407 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-39407" }, "action_statement": "Vulnerability CVE-2026-39407 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39408 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-39408" }, "action_statement": "Vulnerability CVE-2026-39408 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39409 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-39409" }, "action_statement": "Vulnerability CVE-2026-39409 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39410 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-39410" }, "action_statement": "Vulnerability CVE-2026-39410 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44455 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-44455" }, "action_statement": "Vulnerability CVE-2026-44455 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44456 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-44456" }, "action_statement": "Vulnerability CVE-2026-44456 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44457 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-44457" }, "action_statement": "Vulnerability CVE-2026-44457 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44458 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-44458" }, "action_statement": "Vulnerability CVE-2026-44458 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44459 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-44459" }, "action_statement": "Vulnerability CVE-2026-44459 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47673 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-47673" }, "action_statement": "Vulnerability CVE-2026-47673 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47674 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-47674" }, "action_statement": "Vulnerability CVE-2026-47674 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47675 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-47675" }, "action_statement": "Vulnerability CVE-2026-47675 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47676 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-47676" }, "action_statement": "Vulnerability CVE-2026-47676 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54286 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-54286" }, "action_statement": "Vulnerability CVE-2026-54286 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54287 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-54287" }, "action_statement": "Vulnerability CVE-2026-54287 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54288 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-54288" }, "action_statement": "Vulnerability CVE-2026-54288 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54289 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-54289" }, "action_statement": "Vulnerability CVE-2026-54289 affects version 4.12.7 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-13T19:44:07.181677+00:00", "status_notes": "Vulnerability CVE-2026-54290 does not affect version 4.12.7 of hono. not_affected \u2014 hono 4.12.7 is not affected. In src/middleware/cors/index.ts the default wildcard origin returns the literal '*' and never reflects the request Origin. With credentials: true this yields the spec-invalid '*' plus 'Allow-Credentials: true' pair, which browsers reject, so it fails closed. The reflecting behaviour the CVE describes is not in this code.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54290" }, "impact_statement": "not_affected \u2014 hono 4.12.7 is not affected. In src/middleware/cors/index.ts the default wildcard origin returns the literal '*' and never reflects the request Origin. With credentials: true this yields the spec-invalid '*' plus 'Allow-Credentials: true' pair, which browsers reject, so it fails closed. The reflecting behaviour the CVE describes is not in this code." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56761 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-56761" }, "action_statement": "Vulnerability CVE-2026-56761 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-10-15T13:00:40.103707+00:00", "status_notes": "Vulnerability CVE-2026-56762 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-56762" }, "action_statement": "Vulnerability CVE-2026-56762 affects version 4.12.7 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-13T19:55:00.037891+00:00", "status_notes": "Vulnerability CVE-2026-56763 does not affect version 4.12.7 of hono. not_affected \u2014 Hono 4.12.7 already contains the upstream fix (commit ef902257, author taku@taaas.jp). handleParsingNestedValues in src/utils/body.ts returns early for any dotted key containing a `__proto__` path segment, so parseBody({dot:true}) cannot build an object with a `__proto__` property. The fix shipped in the upstream release, before the first TuxCare commit (01d41dd4), so it is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56763" }, "impact_statement": "not_affected \u2014 Hono 4.12.7 already contains the upstream fix (commit ef902257, author taku@taaas.jp). handleParsingNestedValues in src/utils/body.ts returns early for any dotted key containing a `__proto__` path segment, so parseBody({dot:true}) cannot build an object with a `__proto__` property. The fix shipped in the upstream release, before the first TuxCare commit (01d41dd4), so it is not a TuxCare backport." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59895 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-59895" }, "action_statement": "Vulnerability CVE-2026-59895 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59896 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-59896" }, "action_statement": "Vulnerability CVE-2026-59896 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59897 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-59897" }, "action_statement": "Vulnerability CVE-2026-59897 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69207 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-69207" }, "action_statement": "Vulnerability CVE-2026-69207 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71848 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-71848" }, "action_statement": "Vulnerability CVE-2026-71848 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71849 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-71849" }, "action_statement": "Vulnerability CVE-2026-71849 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71850 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-71850" }, "action_statement": "Vulnerability CVE-2026-71850 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84363 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-84363" }, "action_statement": "Vulnerability CVE-2026-84363 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84364 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-84364" }, "action_statement": "Vulnerability CVE-2026-84364 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84365 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-84365" }, "action_statement": "Vulnerability CVE-2026-84365 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-30T23:54:00.098505+00:00", "status_notes": "Vulnerability CVE-2026-93981 affects version 4.12.7 of hono.", "vulnerability": { "name": "CVE-2026-93981" }, "action_statement": "Vulnerability CVE-2026-93981 affects version 4.12.7 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-26pp-8wgv-hjvm affects version 4.12.7 of hono.", "vulnerability": { "name": "GHSA-26pp-8wgv-hjvm" }, "action_statement": "Vulnerability GHSA-26pp-8wgv-hjvm affects version 4.12.7 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability GHSA-3wcj-gjvf-fvch is a false positive for hono 4.12.7.", "vulnerability": { "name": "GHSA-3wcj-gjvf-fvch" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-10-26T21:00:17.311477+00:00", "status_notes": "Vulnerability GHSA-55cm-p4ww-685g is a false positive for hono 4.12.7.", "vulnerability": { "name": "GHSA-55cm-p4ww-685g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-6623-4q32-82v8 is a false positive for hono 4.12.7.", "vulnerability": { "name": "GHSA-6623-4q32-82v8" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability GHSA-cw3j-28qq-x3xh is a false positive for hono 4.12.7.", "vulnerability": { "name": "GHSA-cw3j-28qq-x3xh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.7", "identifiers": { "purl": "pkg:npm/hono@4.12.7" } } ], "timestamp": "2026-11-13T19:51:24.435252+00:00", "status_notes": "Vulnerability GHSA-gq3j-xvxp-8hrf does not affect version 4.12.7 of hono. not_affected \u2014 Hono 4.12.7 already contains the upstream fix for GHSA-gq3j-xvxp-8hrf. src/utils/buffer.ts compares hash values and the original strings with a constant-time XOR/OR loop (constantTimeEqualString) instead of ===. The fix is upstream commit 91def7ca (author yusuke@kamawada.com). It is in the upstream 4.12.7 release that TuxCare onboarded, so it is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-gq3j-xvxp-8hrf" }, "impact_statement": "not_affected \u2014 Hono 4.12.7 already contains the upstream fix for GHSA-gq3j-xvxp-8hrf. src/utils/buffer.ts compares hash values and the original strings with a constant-time XOR/OR loop (constantTimeEqualString) instead of ===. The fix is upstream commit 91def7ca (author yusuke@kamawada.com). It is in the upstream 4.12.7 release that TuxCare onboarded, so it is not a TuxCare backport." } ] }