How many CVEs have a located fix in honojs/hono?

39 published CVEs have a fix traced to functions in honojs/hono, touching 45 functions across 35 files.

Which function in honojs/hono has been patched by the most CVEs?

convertIPv4MappedIPv6ToIPv4 in src/middleware/ip-restriction/index.ts has been changed by 2 CVE fixes, from 2026 to 2026.

How large is a typical CVE fix in honojs/hono?

The median fix changes 16 lines. 54% of fixes change 20 lines or fewer, and 54% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

typescript

#110 of 500 repositories

honojs/hono

Name: honojs/hono: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix September 19, 2026

39

CVE fixes located

Published CVEs

45

Functions patched

Distinct function sites

35

Files patched

Distinct source files

2023–2026

Years covered

By CVE publication date

Overview

39 published CVEs have a fix traced to functions in honojs/hono, the earliest published in 2023. Those fixes changed 45 distinct functions across 35 files, in 265 patch hunks.

Among the 500 repositories tracked here, honojs/hono ranks #110 by the number of CVEs with a located fix.

Most patched functions

Functions in honojs/hono changed by the most CVE fixes.

Most patched files

Files in honojs/hono changed by the most CVE fixes.

1src/utils/cookie.ts4 CVEs · 0 functions
2src/jsx/base.ts3 CVEs · 5 functions
3src/utils/jwt/types.ts3 CVEs · 4 functions
4src/utils/jwt/jwt.ts3 CVEs · 3 functions
5src/jsx/components.ts3 CVEs · 2 functions
6src/middleware/serve-static/index.ts3 CVEs · 1 functions
7src/utils/ipaddr.ts3 CVEs · 1 functions
8src/utils/url.ts3 CVEs · 1 functions
9src/jsx/context.ts2 CVEs · 3 functions
10src/middleware/csrf/index.ts2 CVEs · 2 functions

Fix size

How much code a CVE fix in honojs/hono changes, with backports counted once.

16

Median lines changed

Added plus removed, per CVE

54%

Fixes of 20 lines or fewer

Share of CVE fixes

54%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in honojs/hono, and the functions each fix changed.

hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings
CVE-2026-93981renderChildren raw flat
Low · CVSS 2.3
EPSS 0.2%2026-09-19
Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory
CVE-2026-84365
Medium · CVSS 6.5
EPSS 0.4%2026-09-01
Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion
CVE-2026-84364BodyDataValueDot convertFormDataToBodyData
Medium · CVSS 5.3
EPSS 0.5%2026-09-01
Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
CVE-2026-84363slice
Medium · CVSS 5.9
EPSS 0.4%2026-09-01
Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
CVE-2026-69207
Medium · CVSS 5.3
EPSS 0.6%2026-08-07
Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure
CVE-2026-71850
Medium · CVSS 4.8
EPSS 0.3%2026-08-07
Hono: Proxy Helper does not remove response headers listed in the `Connection` header
CVE-2026-71849split
Low · CVSS 3.7
EPSS 0.4%2026-08-07
Hono: Algorithmic Complexity DoS in Language Middleware
CVE-2026-71848
Medium · CVSS 5.3
EPSS 0.5%2026-08-07
Hono - Prototype Pollution via __proto__ Key in parseBody with dot Option
CVE-2026-56763
Medium · CVSS 6.3
EPSS 0.3%2026-07-11
Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility
CVE-2026-59895
Medium · CVSS 6.1
EPSS 0.3%2026-07-08
hono/jsx does not isolate context per request, leading to cross-request data disclosure
CVE-2026-59896RenderStore stringBufferToString finally
Medium · CVSS 6.5
EPSS 0.3%2026-07-08
Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication
CVE-2026-59897getHeaders LatticeV2Processor
Medium · CVSS 5.3
EPSS 0.2%2026-07-08

Get an alert for each new honojs/hono CVE, with the patched functions and AI-written analysis.

Monitor hono CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

Combodo/iTop39 CVEs debian/xorg-server39 CVEs facebook/hhvm39 CVEs givanz/Vvveb39 CVEs rabbitmq/rabbitmq-server39 CVEs vercel/next.js39 CVEs apache/struts40 CVEs Exiv2/exiv240 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in honojs/hono.

How many CVEs have a located fix in honojs/hono?: 39 published CVEs have a fix traced to functions in honojs/hono, touching 45 functions across 35 files.
Which function in honojs/hono has been patched by the most CVEs?: convertIPv4MappedIPv6ToIPv4 in src/middleware/ip-restriction/index.ts has been changed by 2 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in honojs/hono?: The median fix changes 16 lines. 54% of fixes change 20 lines or fewer, and 54% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track honojs/hono CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing