Exposição de Hono
Web frameworks29
score de exposição
57
sites usam
0
em exploração
0
críticos
Análise Vexday
Hono acumula 38 CVEs catalogadas, com nenhuma em exploração ativa confirmada pelo CISA KEV, taxa que se situa abaixo da média geral do catálogo. O dado que merece atenção imediata é a concentração de 21 vulnerabilidades surgidas nos últimos 90 dias, indicando um ritmo recente de descobertas elevado para o período. O tipo de falha mais recorrente é CWE-22 (Path Traversal), padrão que tipicamente permite a um atacante acessar arquivos fora do diretório pretendido pela aplicação, e a CVE mais perigosa ativa no momento, CVE-2024-32869, apresenta EPSS de 0,0064 — probabilidade de exploração ainda baixa, mas que deve ser monitorada dado o volume recente de novas entradas.
CVEs
44 resultadosCVE-2026-56762MEDIUMHono - Missing Cookie Name Validation in setCookie()EPSS 0.2%CVE-2026-42349HIGHClerk: Authorization bypass when combining organization, billing, or reverification checksEPSS 0.2%CVE-2026-27700HIGHHono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfoEPSS 0.2%CVE-2026-47674MEDIUMHono: IP Restriction bypasses static deny rules for non-canonical IPv6EPSS 0.2%CVE-2024-43787MEDIUMHono CSRF middleware can be bypassed using crafted Content-Type headerEPSS 0.2%CVE-2026-29085MEDIUMHono: SSE Control Field Injection via CR/LF in writeSSE()EPSS 0.2%CVE-2026-56764MEDIUMHono - Timing Attack in basicAuth and bearerAuth MiddlewareEPSS 0.2%CVE-2026-44456MEDIUMHono: bodyLimit() can be bypassed for chunked / unknown-length requestsEPSS 0.2%CVE-2026-29086MEDIUMHono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()EPSS 0.2%CVE-2026-47675MEDIUMHono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injectionEPSS 0.2%CVE-2026-44459LOWHono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()EPSS 0.2%CVE-2026-47673MEDIUMHono: JWT middleware accepts any Authorization scheme, not only BearerEPSS 0.2%CVE-2026-59895MEDIUMHono: Server-Side XSS via JSX Escaping Bypass in cx() UtilityEPSS 0.2%CVE-2026-44457MEDIUMHono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakageEPSS 0.2%CVE-2026-44458MEDIUMHono: CSS Declaration Injection via Style Object Values in JSX SSREPSS 0.2%CVE-2026-59896MEDIUMhono/jsx does not isolate context per request, leading to cross-request data disclosureEPSS 0.2%CVE-2026-54289MEDIUMHono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the restEPSS 0.2%CVE-2026-56763MEDIUMHono - Prototype Pollution via __proto__ Key in parseBody with dot OptionEPSS 0.2%CVE-2026-56761MEDIUMhono - HTML Injection via Improper JSX Attribute Name Handling in SSREPSS 0.2%CVE-2026-54288MEDIUMHono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`EPSS 0.1%