{ "@id": "urn:uuid:ded4daab-8284-4324-a0c4-7238e5c96553", "role": "Document Creator", "author": "https://tuxcare.com", "version": 21, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T16:33:00.077545+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2023-50710 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2023-50710" }, "action_statement": "Vulnerability CVE-2023-50710 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-32869 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2024-32869" }, "action_statement": "Vulnerability CVE-2024-32869 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-43787 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2024-43787" }, "action_statement": "Vulnerability CVE-2024-43787 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-48913 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2024-48913" }, "action_statement": "Vulnerability CVE-2024-48913 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-58362 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2025-58362" }, "action_statement": "Vulnerability CVE-2025-58362 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-59139 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2025-59139" }, "action_statement": "Vulnerability CVE-2025-59139 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-62610 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2025-62610" }, "action_statement": "Vulnerability CVE-2025-62610 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-10-29T20:31:24.273560+00:00", "status_notes": "Vulnerability CVE-2025-71381 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2025-71381" }, "action_statement": "Vulnerability CVE-2025-71381 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-10-20T14:41:00.226982+00:00", "status_notes": "Vulnerability CVE-2026-111757 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-111757" }, "action_statement": "Vulnerability CVE-2026-111757 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-12T23:39:00.066400+00:00", "status_notes": "Vulnerability CVE-2026-126355 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-126355" }, "action_statement": "Vulnerability CVE-2026-126355 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-12T23:39:00.066400+00:00", "status_notes": "Vulnerability CVE-2026-126356 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-126356" }, "action_statement": "Vulnerability CVE-2026-126356 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126357 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-126357" }, "action_statement": "Vulnerability CVE-2026-126357 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126358 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-126358" }, "action_statement": "Vulnerability CVE-2026-126358 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126359 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-126359" }, "action_statement": "Vulnerability CVE-2026-126359 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-22817 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-22817" }, "action_statement": "Vulnerability CVE-2026-22817 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-22818 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-22818" }, "action_statement": "Vulnerability CVE-2026-22818 affects version 4.12.9 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-13T19:50:04.403996+00:00", "status_notes": "Vulnerability CVE-2026-24398 does not affect version 4.12.9 of hono. not_affected \u2014 Hono 4.12.9 already contains the upstream fix for CVE-2026-24398. IPV4_REGEX in src/utils/ipaddr.ts is built from a strict 0-255 octet pattern, so out-of-range octets such as 1.2.2.355 are rejected before convertIPv4ToBinary runs. The fix shipped in the upstream release, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24398" }, "impact_statement": "not_affected \u2014 Hono 4.12.9 already contains the upstream fix for CVE-2026-24398. IPV4_REGEX in src/utils/ipaddr.ts is built from a strict 0-255 octet pattern, so out-of-range octets such as 1.2.2.355 are rejected before convertIPv4ToBinary runs. The fix shipped in the upstream release, so the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-13T19:47:11.992608+00:00", "status_notes": "Vulnerability CVE-2026-24472 does not affect version 4.12.9 of hono. not_affected \u2014 Hono 4.12.9 already contains the upstream fix for CVE-2026-24472 (commit 12c5117, \"Merge commit from fork\"). The cache middleware's shouldSkipCache() skips caching when Cache-Control contains private, no-store or no-cache. It also skips on Vary: * and on Set-Cookie. The fix shipped in the upstream release, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24472" }, "impact_statement": "not_affected \u2014 Hono 4.12.9 already contains the upstream fix for CVE-2026-24472 (commit 12c5117, \"Merge commit from fork\"). The cache middleware's shouldSkipCache() skips caching when Cache-Control contains private, no-store or no-cache. It also skips on Vary: * and on Set-Cookie. The fix shipped in the upstream release, so the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-13T19:51:00.041863+00:00", "status_notes": "Vulnerability CVE-2026-24473 does not affect version 4.12.9 of hono. not_affected \u2014 The upstream fix for CVE-2026-24473 (honojs/hono cf9a78db) is already in the target's upstream release. The vulnerable fallback `ASSET_MANIFEST[path] || path` is gone from getContentFromKVAsset, so the Cloudflare Workers serve-static adapter can no longer read KV keys that are not listed in the manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24473" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-24473 (honojs/hono cf9a78db) is already in the target's upstream release. The vulnerable fallback `ASSET_MANIFEST[path] || path` is gone from getContentFromKVAsset, so the Cloudflare Workers serve-static adapter can no longer read KV keys that are not listed in the manifest." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-13T19:49:00.036571+00:00", "status_notes": "Vulnerability CVE-2026-24771 does not affect version 4.12.9 of hono. not_affected \u2014 Hono 4.12.9 already contains the upstream fix for CVE-2026-24771. Commit 2cf60046d730df9fd0aba85178f3ecfe8212d990 (author taku@taaas.jp, upstream) is an ancestor of HEAD. The ErrorBoundary in src/jsx/components.ts no longer forces children or fallback output to be raw HTML. The fix shipped in the upstream release, before any TuxCare commit, so it is upstream-attributed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24771" }, "impact_statement": "not_affected \u2014 Hono 4.12.9 already contains the upstream fix for CVE-2026-24771. Commit 2cf60046d730df9fd0aba85178f3ecfe8212d990 (author taku@taaas.jp, upstream) is an ancestor of HEAD. The ErrorBoundary in src/jsx/components.ts no longer forces children or fallback output to be raw HTML. The fix shipped in the upstream release, before any TuxCare commit, so it is upstream-attributed." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-27700 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-27700" }, "action_statement": "Vulnerability CVE-2026-27700 affects version 4.12.9 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-13T19:46:34.497162+00:00", "status_notes": "Vulnerability CVE-2026-29045 does not affect version 4.12.9 of hono. not_affected \u2014 Target is hono 4.12.9. The upstream fix 6a0607a9 (serve-static: replace decodeURIComponent with tryDecodeURI) is already in HEAD's history. src/middleware/serve-static/index.ts:66 now decodes with tryDecodeURI (decodeURI semantics), which matches the router's getPath decoding, so %2F is no longer turned into '/'. The vulnerable pattern is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29045" }, "impact_statement": "not_affected \u2014 Target is hono 4.12.9. The upstream fix 6a0607a9 (serve-static: replace decodeURIComponent with tryDecodeURI) is already in HEAD's history. src/middleware/serve-static/index.ts:66 now decodes with tryDecodeURI (decodeURI semantics), which matches the router's getPath decoding, so %2F is no longer turned into '/'. The vulnerable pattern is absent." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-13T19:51:00.041863+00:00", "status_notes": "Vulnerability CVE-2026-29085 does not affect version 4.12.9 of hono. not_affected \u2014 hono 4.12.9 already contains the upstream fix for CVE-2026-29085. SSEStreamingApi.writeSSE() in src/helper/streaming/sse.ts rejects CR/LF in the event, id and retry fields before the frame is built. The fix is upstream commit f4123ed9 (author taku@taaas.jp), which is an ancestor of HEAD. HEAD has no TuxCare-domain commits, so this is an upstream fix shipped in the release and not a TuxCare back...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29085" }, "impact_statement": "not_affected \u2014 hono 4.12.9 already contains the upstream fix for CVE-2026-29085. SSEStreamingApi.writeSSE() in src/helper/streaming/sse.ts rejects CR/LF in the event, id and retry fields before the frame is built. The fix is upstream commit f4123ed9 (author taku@taaas.jp), which is an ancestor of HEAD. HEAD has no TuxCare-domain commits, so this is an upstream fix shipped in the release and not a TuxCare back..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-13T19:49:46.782400+00:00", "status_notes": "Vulnerability CVE-2026-29086 does not affect version 4.12.9 of hono. not_affected \u2014 Hono 4.12.9 already contains the upstream fix for CVE-2026-29086. The serializer `_serialize` in src/utils/cookie.ts (lines 164-168) throws if `domain` or `path` contains ';', '\\r' or '\\n', before either value is added to the Set-Cookie string. Upstream commit 44ae0c8c (author taku@taaas.jp) is an ancestor of HEAD and of the upstream 4.12.9 release commit e1ae0eb0. No TuxCare-domain commit is i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29086" }, "impact_statement": "not_affected \u2014 Hono 4.12.9 already contains the upstream fix for CVE-2026-29086. The serializer `_serialize` in src/utils/cookie.ts (lines 164-168) throws if `domain` or `path` contains ';', '\\r' or '\\n', before either value is added to the Set-Cookie string. Upstream commit 44ae0c8c (author taku@taaas.jp) is an ancestor of HEAD and of the upstream 4.12.9 release commit e1ae0eb0. No TuxCare-domain commit is i..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39407 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-39407" }, "action_statement": "Vulnerability CVE-2026-39407 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39408 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-39408" }, "action_statement": "Vulnerability CVE-2026-39408 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-14T16:33:00.077545+00:00", "status_notes": "Vulnerability CVE-2026-39409 affects version 4.12.9 of hono, and is fixed in 4.12.9-tuxcare.1.", "vulnerability": { "name": "CVE-2026-39409" }, "action_statement": "Vulnerability CVE-2026-39409 affects version 4.12.9 of hono, and is fixed in 4.12.9-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-14T16:32:55.212742+00:00", "status_notes": "Vulnerability CVE-2026-39410 affects version 4.12.9 of hono, and is fixed in 4.12.9-tuxcare.1.", "vulnerability": { "name": "CVE-2026-39410" }, "action_statement": "Vulnerability CVE-2026-39410 affects version 4.12.9 of hono, and is fixed in 4.12.9-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44455 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-44455" }, "action_statement": "Vulnerability CVE-2026-44455 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44456 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-44456" }, "action_statement": "Vulnerability CVE-2026-44456 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44457 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-44457" }, "action_statement": "Vulnerability CVE-2026-44457 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44458 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-44458" }, "action_statement": "Vulnerability CVE-2026-44458 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44459 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-44459" }, "action_statement": "Vulnerability CVE-2026-44459 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47673 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-47673" }, "action_statement": "Vulnerability CVE-2026-47673 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47674 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-47674" }, "action_statement": "Vulnerability CVE-2026-47674 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47675 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-47675" }, "action_statement": "Vulnerability CVE-2026-47675 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47676 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-47676" }, "action_statement": "Vulnerability CVE-2026-47676 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54286 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-54286" }, "action_statement": "Vulnerability CVE-2026-54286 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54287 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-54287" }, "action_statement": "Vulnerability CVE-2026-54287 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54288 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-54288" }, "action_statement": "Vulnerability CVE-2026-54288 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54289 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-54289" }, "action_statement": "Vulnerability CVE-2026-54289 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54290 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-54290" }, "action_statement": "Vulnerability CVE-2026-54290 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-14T16:33:00.077545+00:00", "status_notes": "Vulnerability CVE-2026-56761 affects version 4.12.9 of hono, and is fixed in 4.12.9-tuxcare.1.", "vulnerability": { "name": "CVE-2026-56761" }, "action_statement": "Vulnerability CVE-2026-56761 affects version 4.12.9 of hono, and is fixed in 4.12.9-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-14T16:33:00.077545+00:00", "status_notes": "Vulnerability CVE-2026-56762 affects version 4.12.9 of hono, and is fixed in 4.12.9-tuxcare.1.", "vulnerability": { "name": "CVE-2026-56762" }, "action_statement": "Vulnerability CVE-2026-56762 affects version 4.12.9 of hono, and is fixed in 4.12.9-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-13T19:55:00.037891+00:00", "status_notes": "Vulnerability CVE-2026-56763 does not affect version 4.12.9 of hono. not_affected \u2014 The upstream fix (hono commit ef902257, author taku@taaas.jp) is already present in the target (hono 4.12.9). handleParsingNestedValues in src/utils/body.ts now returns early for any key containing a '__proto__.' path segment, so such keys never reach the nested-object builder. The fix shipped in the upstream 4.12.9 release, before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56763" }, "impact_statement": "not_affected \u2014 The upstream fix (hono commit ef902257, author taku@taaas.jp) is already present in the target (hono 4.12.9). handleParsingNestedValues in src/utils/body.ts now returns early for any key containing a '__proto__.' path segment, so such keys never reach the nested-object builder. The fix shipped in the upstream 4.12.9 release, before the first TuxCare commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59895 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-59895" }, "action_statement": "Vulnerability CVE-2026-59895 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59896 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-59896" }, "action_statement": "Vulnerability CVE-2026-59896 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59897 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-59897" }, "action_statement": "Vulnerability CVE-2026-59897 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69207 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-69207" }, "action_statement": "Vulnerability CVE-2026-69207 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71848 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-71848" }, "action_statement": "Vulnerability CVE-2026-71848 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71849 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-71849" }, "action_statement": "Vulnerability CVE-2026-71849 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71850 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-71850" }, "action_statement": "Vulnerability CVE-2026-71850 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84363 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-84363" }, "action_statement": "Vulnerability CVE-2026-84363 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84364 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-84364" }, "action_statement": "Vulnerability CVE-2026-84364 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84365 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-84365" }, "action_statement": "Vulnerability CVE-2026-84365 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-30T23:54:00.098505+00:00", "status_notes": "Vulnerability CVE-2026-93981 affects version 4.12.9 of hono.", "vulnerability": { "name": "CVE-2026-93981" }, "action_statement": "Vulnerability CVE-2026-93981 affects version 4.12.9 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-26pp-8wgv-hjvm affects version 4.12.9 of hono.", "vulnerability": { "name": "GHSA-26pp-8wgv-hjvm" }, "action_statement": "Vulnerability GHSA-26pp-8wgv-hjvm affects version 4.12.9 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability GHSA-3wcj-gjvf-fvch is a false positive for hono 4.12.9.", "vulnerability": { "name": "GHSA-3wcj-gjvf-fvch" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-10-26T21:00:17.311477+00:00", "status_notes": "Vulnerability GHSA-55cm-p4ww-685g is a false positive for hono 4.12.9.", "vulnerability": { "name": "GHSA-55cm-p4ww-685g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-6623-4q32-82v8 is a false positive for hono 4.12.9.", "vulnerability": { "name": "GHSA-6623-4q32-82v8" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability GHSA-cw3j-28qq-x3xh is a false positive for hono 4.12.9.", "vulnerability": { "name": "GHSA-cw3j-28qq-x3xh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.12.9", "identifiers": { "purl": "pkg:npm/hono@4.12.9" } } ], "timestamp": "2026-11-13T19:52:00.137305+00:00", "status_notes": "Vulnerability GHSA-gq3j-xvxp-8hrf does not affect version 4.12.9 of hono. not_affected \u2014 Not affected. The target (hono 4.12.9) already contains the upstream fix for GHSA-gq3j-xvxp-8hrf. src/utils/buffer.ts compares hashes with constantTimeEqualString, which has no early exit. It does not use `===`. The fix is upstream commit 91def7cab654bad5eecc9270e6620d577971ff5e. It is an ancestor of HEAD, and HEAD has no commits from a TuxCare/CloudLinux author domain.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-gq3j-xvxp-8hrf" }, "impact_statement": "not_affected \u2014 Not affected. The target (hono 4.12.9) already contains the upstream fix for GHSA-gq3j-xvxp-8hrf. src/utils/buffer.ts compares hashes with constantTimeEqualString, which has no early exit. It does not use `===`. The fix is upstream commit 91def7cab654bad5eecc9270e6620d577971ff5e. It is an ancestor of HEAD, and HEAD has no commits from a TuxCare/CloudLinux author domain." } ] }