Hono

Hono allows bypass of CSRF Middleware by a request without Content-Type header.

Hono missing validation of cookie name on write path in setCookie()

Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Hono vulnerable to Restricted Directory Traversal in serveStatic with deno

Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)

hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR

Hono: Algorithmic Complexity DoS in Language Middleware

Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()

Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths