Hono

Hono allows bypass of CSRF Middleware by a request without Content-Type header.

Hono missing validation of cookie name on write path in setCookie()

Hono vulnerable to Restricted Directory Traversal in serveStatic with deno

Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)

hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR

Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()

hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection

Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception

Hono has Body Limit Middleware Bypass

Hono's flaw in URL path parsing could cause path confusion