{ "@id": "urn:uuid:ada34925-63eb-4c45-a84c-69eb9f793b6e", "role": "Document Creator", "author": "https://tuxcare.com", "version": 15, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T03:08:38.532104+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2023-50710 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2023-50710" }, "action_statement": "Vulnerability CVE-2023-50710 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-32869 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2024-32869" }, "action_statement": "Vulnerability CVE-2024-32869 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2024-43787 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2024-43787" }, "action_statement": "Vulnerability CVE-2024-43787 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-48913 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2024-48913" }, "action_statement": "Vulnerability CVE-2024-48913 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2025-58362 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2025-58362" }, "action_statement": "Vulnerability CVE-2025-58362 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59139 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2025-59139" }, "action_statement": "Vulnerability CVE-2025-59139 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62610 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2025-62610" }, "action_statement": "Vulnerability CVE-2025-62610 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-10-02T18:38:01.031976+00:00", "status_notes": "Vulnerability CVE-2025-71381 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2025-71381" }, "action_statement": "Vulnerability CVE-2025-71381 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability CVE-2026-111757 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-111757" }, "action_statement": "Vulnerability CVE-2026-111757 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-11-12T23:39:00.066400+00:00", "status_notes": "Vulnerability CVE-2026-126355 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-126355" }, "action_statement": "Vulnerability CVE-2026-126355 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-11-12T23:39:00.066400+00:00", "status_notes": "Vulnerability CVE-2026-126356 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-126356" }, "action_statement": "Vulnerability CVE-2026-126356 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126357 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-126357" }, "action_statement": "Vulnerability CVE-2026-126357 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126358 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-126358" }, "action_statement": "Vulnerability CVE-2026-126358 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-11-12T23:34:00.186785+00:00", "status_notes": "Vulnerability CVE-2026-126359 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-126359" }, "action_statement": "Vulnerability CVE-2026-126359 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22817 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-22817" }, "action_statement": "Vulnerability CVE-2026-22817 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22818 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-22818" }, "action_statement": "Vulnerability CVE-2026-22818 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24398 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-24398" }, "action_statement": "Vulnerability CVE-2026-24398 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24472 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-24472" }, "action_statement": "Vulnerability CVE-2026-24472 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24473 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-24473" }, "action_statement": "Vulnerability CVE-2026-24473 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24771 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-24771" }, "action_statement": "Vulnerability CVE-2026-24771 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-11-01T02:06:00.210039+00:00", "status_notes": "Vulnerability CVE-2026-27700 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-27700" }, "action_statement": "Vulnerability CVE-2026-27700 affects version 4.5.8 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-11-14T02:45:36.676709+00:00", "status_notes": "Vulnerability CVE-2026-29045 does not affect version 4.5.8 of hono. not_affected \u2014 Hono 4.5.8 does not have the router/serveStatic decoding mismatch from CVE-2026-29045. The router path (getPath -> tryDecodeURI) and serveStatic (decodeURI(c.req.path)) both use decodeURI semantics, which leave %2F as the literal string. An encoded slash therefore never becomes a real '/' between route matching and file resolution. No adapter decodes the path again. Only the CVE text was availa...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-29045" }, "impact_statement": "not_affected \u2014 Hono 4.5.8 does not have the router/serveStatic decoding mismatch from CVE-2026-29045. The router path (getPath -> tryDecodeURI) and serveStatic (decodeURI(c.req.path)) both use decodeURI semantics, which leave %2F as the literal string. An encoded slash therefore never becomes a real '/' between route matching and file resolution. No adapter decodes the path again. Only the CVE text was availa..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29085 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-29085" }, "action_statement": "Vulnerability CVE-2026-29085 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29086 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-29086" }, "action_statement": "Vulnerability CVE-2026-29086 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39407 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-39407" }, "action_statement": "Vulnerability CVE-2026-39407 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39408 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-39408" }, "action_statement": "Vulnerability CVE-2026-39408 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39409 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-39409" }, "action_statement": "Vulnerability CVE-2026-39409 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39410 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-39410" }, "action_statement": "Vulnerability CVE-2026-39410 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44455 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-44455" }, "action_statement": "Vulnerability CVE-2026-44455 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44456 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-44456" }, "action_statement": "Vulnerability CVE-2026-44456 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44457 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-44457" }, "action_statement": "Vulnerability CVE-2026-44457 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44458 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-44458" }, "action_statement": "Vulnerability CVE-2026-44458 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44459 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-44459" }, "action_statement": "Vulnerability CVE-2026-44459 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47673 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-47673" }, "action_statement": "Vulnerability CVE-2026-47673 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47674 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-47674" }, "action_statement": "Vulnerability CVE-2026-47674 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47675 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-47675" }, "action_statement": "Vulnerability CVE-2026-47675 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47676 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-47676" }, "action_statement": "Vulnerability CVE-2026-47676 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54286 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-54286" }, "action_statement": "Vulnerability CVE-2026-54286 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54287 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-54287" }, "action_statement": "Vulnerability CVE-2026-54287 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54288 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-54288" }, "action_statement": "Vulnerability CVE-2026-54288 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54289 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-54289" }, "action_statement": "Vulnerability CVE-2026-54289 affects version 4.5.8 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-11-14T02:43:23.718472+00:00", "status_notes": "Vulnerability CVE-2026-54290 does not affect version 4.5.8 of hono. not_affected \u2014 Hono 4.5.8 CORS middleware does not reflect the request Origin when origin is the default wildcard. With credentials:true it emits `Access-Control-Allow-Origin: *`. The spec forbids that combination, so browsers reject the credentialed response. This is the old fail-closed behavior; the reflecting regression the CVE describes is not present in this version.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54290" }, "impact_statement": "not_affected \u2014 Hono 4.5.8 CORS middleware does not reflect the request Origin when origin is the default wildcard. With credentials:true it emits `Access-Control-Allow-Origin: *`. The spec forbids that combination, so browsers reject the credentialed response. This is the old fail-closed behavior; the reflecting regression the CVE describes is not present in this version." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56761 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-56761" }, "action_statement": "Vulnerability CVE-2026-56761 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-10-15T13:01:46.153746+00:00", "status_notes": "Vulnerability CVE-2026-56762 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-56762" }, "action_statement": "Vulnerability CVE-2026-56762 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-10-02T22:43:00.206659+00:00", "status_notes": "Vulnerability CVE-2026-56763 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-56763" }, "action_statement": "Vulnerability CVE-2026-56763 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59895 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-59895" }, "action_statement": "Vulnerability CVE-2026-59895 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-11-01T02:07:00.172771+00:00", "status_notes": "Vulnerability CVE-2026-59896 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-59896" }, "action_statement": "Vulnerability CVE-2026-59896 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59897 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-59897" }, "action_statement": "Vulnerability CVE-2026-59897 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69207 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-69207" }, "action_statement": "Vulnerability CVE-2026-69207 affects version 4.5.8 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-11-14T03:06:00.073410+00:00", "status_notes": "Vulnerability CVE-2026-71848 does not affect version 4.5.8 of hono. not_affected \u2014 Target is hono 4.5.8. It has no languageDetector middleware and no normalizeLanguage() function, so the vulnerable quadratic prefix-truncation code does not exist. The middleware was added in a later Hono release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-71848" }, "impact_statement": "not_affected \u2014 Target is hono 4.5.8. It has no languageDetector middleware and no normalizeLanguage() function, so the vulnerable quadratic prefix-truncation code does not exist. The middleware was added in a later Hono release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-11-14T03:08:38.532104+00:00", "status_notes": "Vulnerability CVE-2026-71849 does not affect version 4.5.8 of hono. not_affected \u2014 Hono 4.5.8 does not contain the Proxy Helper (hono/proxy, src/helper/proxy) that the CVE and patch concern. The helper was added in a later release. The vulnerable proxy() function is absent from the repo, so the flaw cannot occur here. This is the right product (hono) at an older version, so the verdict is not_affected rather than false_positive.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-71849" }, "impact_statement": "not_affected \u2014 Hono 4.5.8 does not contain the Proxy Helper (hono/proxy, src/helper/proxy) that the CVE and patch concern. The helper was added in a later release. The vulnerable proxy() function is absent from the repo, so the flaw cannot occur here. This is the right product (hono) at an older version, so the verdict is not_affected rather than false_positive." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71850 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-71850" }, "action_statement": "Vulnerability CVE-2026-71850 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84363 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-84363" }, "action_statement": "Vulnerability CVE-2026-84363 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84364 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-84364" }, "action_statement": "Vulnerability CVE-2026-84364 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84365 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-84365" }, "action_statement": "Vulnerability CVE-2026-84365 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-30T23:54:00.098505+00:00", "status_notes": "Vulnerability CVE-2026-93981 affects version 4.5.8 of hono.", "vulnerability": { "name": "CVE-2026-93981" }, "action_statement": "Vulnerability CVE-2026-93981 affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-26pp-8wgv-hjvm affects version 4.5.8 of hono.", "vulnerability": { "name": "GHSA-26pp-8wgv-hjvm" }, "action_statement": "Vulnerability GHSA-26pp-8wgv-hjvm affects version 4.5.8 of hono." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3wcj-gjvf-fvch is a false positive for hono 4.5.8.", "vulnerability": { "name": "GHSA-3wcj-gjvf-fvch" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-10-26T21:00:17.311477+00:00", "status_notes": "Vulnerability GHSA-55cm-p4ww-685g is a false positive for hono 4.5.8.", "vulnerability": { "name": "GHSA-55cm-p4ww-685g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-6623-4q32-82v8 is a false positive for hono 4.5.8.", "vulnerability": { "name": "GHSA-6623-4q32-82v8" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-cw3j-28qq-x3xh is a false positive for hono 4.5.8.", "vulnerability": { "name": "GHSA-cw3j-28qq-x3xh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gq3j-xvxp-8hrf affects version 4.5.8 of hono.", "vulnerability": { "name": "GHSA-gq3j-xvxp-8hrf" }, "action_statement": "Vulnerability GHSA-gq3j-xvxp-8hrf affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-q7jf-gf43-6x6p affects version 4.5.8 of hono.", "vulnerability": { "name": "GHSA-q7jf-gf43-6x6p" }, "action_statement": "Vulnerability GHSA-q7jf-gf43-6x6p affects version 4.5.8 of hono." }, { "status": "affected", "products": [ { "@id": "pkg:npm/hono@4.5.8", "identifiers": { "purl": "pkg:npm/hono@4.5.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v8w9-8mx6-g223 affects version 4.5.8 of hono.", "vulnerability": { "name": "GHSA-v8w9-8mx6-g223" }, "action_statement": "Vulnerability GHSA-v8w9-8mx6-g223 affects version 4.5.8 of hono." } ] }