Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
Nothing found by this check. ✓
Packages you depend on that have known security holes (CVEs).
CVE-2025-62610 Hono Improper Authorization vulnerabilityCVE-2026-22817 Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth BypassCVE-2026-22818 Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)CVE-2026-29045 Hono vulnerable to arbitrary file access via serveStatic vulnerability CVE-2026-54290 hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcardCVE-2026-24398 Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofingCVE-2026-24472 Hono cache middleware ignores "Cache-Control: private" leading to Web Cache DeceptionCVE-2026-24473 Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)CVE-2026-24771 Hono vulnerable to XSS through ErrorBoundary component CVE-2026-29085 Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()CVE-2026-29086 Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()CVE-2026-39407 Hono: Middleware bypass via repeated slashes in serveStaticCVE-2026-39408 Hono: Path traversal in toSSG() allows writing files outside the output directoryCVE-2026-39409 Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addressesCVE-2026-39410 Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()CVE-2026-44455 hono/jsx has Unvalidated JSX Tag Names that May Allow HTML InjectionCVE-2026-44456 Hono: bodyLimit() can be bypassed for chunked / unknown-length requestsCVE-2026-44457 Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakageCVE-2026-44458 Hono has CSS Declaration Injection via Style Object Values in JSX SSRCVE-2026-47673 Hono: JWT middleware accepts any Authorization scheme, not only BearerCVE-2026-47674 Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 CVE-2026-47675 Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injectionCVE-2026-47676 Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded pathsCVE-2026-54286 hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)CVE-2026-54287 hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and LatticeYour dependencies cross-checked against the OSV vulnerability database.
GHSA-737v-mqg7-c878 defu: Prototype pollution via `__proto__` key in defaults argumentGHSA-26pp-8wgv-hjvm Hono missing validation of cookie name on write path in setCookie()GHSA-2gcr-mfcq-wcc3 Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded pathsGHSA-3hrh-pfw6-9m5x Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injectionGHSA-3vhc-576x-3qv4 Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)GHSA-458j-xx4x-4375 hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSRGHSA-5pq2-9x2x-5p6w Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()GHSA-69xw-7hcm-h432 hono/jsx has Unvalidated JSX Tag Names that May Allow HTML InjectionGHSA-6wqw-2p9w-4vw4 Hono cache middleware ignores "Cache-Control: private" leading to Web Cache DeceptionGHSA-88fw-hqm2-52qc hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcardGHSA-8j4g-w8fx-2239 Hono: ReDoS in CORS middleware via Access-Control-Request-HeadersGHSA-9r54-q6cx-xmh5 Hono vulnerable to XSS through ErrorBoundary component GHSA-9vqf-7f2p-gf9v Hono: bodyLimit() can be bypassed for chunked / unknown-length requestsGHSA-f23p-vx2j-j53r Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosureGHSA-f577-qrjj-4474 Hono: JWT middleware accepts any Authorization scheme, not only BearerGHSA-f67f-6cw9-8mq4 Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth BypassGHSA-j6c9-x7qj-28xf hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and LatticeGHSA-m732-5p4w-x69g Hono Improper Authorization vulnerabilityGHSA-p6xx-57qc-3wxr Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()GHSA-p77w-8qqv-26rm Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakageGHSA-q5qw-h33p-qvwr Hono vulnerable to arbitrary file access via serveStatic vulnerability GHSA-q7jf-gf43-6x6p Hono vulnerable to Vary Header Injection leading to potential CORS BypassGHSA-qp7p-654g-cw7p Hono has CSS Declaration Injection via Style Object Values in JSX SSRGHSA-r354-f388-2fhh Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofingGHSA-r5rp-j6wh-rvv4 Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()Code that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
Nothing found by this check. ✓
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.