gitsafehub
github.com/kong/mcp-konnect ↗

kong/mcp-konnect

scanned 2026-08-14 · git 0f9a72b
2 of 6 checks flagged a security issue
🟡 Worth a look
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secretsVulnerable dependencies31Known OSS vulnerabilities31Risky code patternsMalicious dependenciesProject health

Security checks

Leaked secrets — Gitleaks none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivy 31 found

Packages you depend on that have known security holes (CVEs).

  • Worth fixing GHSA-frvp-7c67-39w9 Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
    package-lock.json
    A package you depend on has a known security hole (GHSA-frvp-7c67-39w9). Fix: Update that package to its patched version.
  • Worth fixing GHSA-gcfj-64vw-6mp9 Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
    package-lock.json
    A package you depend on has a known security hole (GHSA-gcfj-64vw-6mp9). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-67314 axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth
    package-lock.json
    A package you depend on has a known security hole (CVE-2026-67314). Fix: Update that package to its patched version.
  • Worth fixing GHSA-42h9-826w-cgv3 Axios: Excessive recursion in formDataToJSON can cause denial of service
    package-lock.json
    A package you depend on has a known security hole (GHSA-42h9-826w-cgv3). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7q8q-rj6j-mhjq Axios: Nested axios option objects can consume polluted prototype values
    package-lock.json
    A package you depend on has a known security hole (GHSA-7q8q-rj6j-mhjq). Fix: Update that package to its patched version.
  • Worth fixing GHSA-f4gw-2p7v-4548 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
    package-lock.json
    A package you depend on has a known security hole (GHSA-f4gw-2p7v-4548). Fix: Update that package to its patched version.
  • Worth fixing GHSA-hcpx-6fm6-wx23 Axios form serializer maxDepth bypass via {} metatoken
    package-lock.json
    A package you depend on has a known security hole (GHSA-hcpx-6fm6-wx23). Fix: Update that package to its patched version.
  • Worth fixing GHSA-jqh4-m9w3-8hp9 Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
    package-lock.json
    A package you depend on has a known security hole (GHSA-jqh4-m9w3-8hp9). Fix: Update that package to its patched version.
  • Worth fixing GHSA-mmx7-hfxf-jppx Axios: Prototype pollution gadgets can alter axios request construction
    package-lock.json
    A package you depend on has a known security hole (GHSA-mmx7-hfxf-jppx). Fix: Update that package to its patched version.
  • Worth fixing GHSA-mwf2-3pr3-8698 Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
    package-lock.json
    A package you depend on has a known security hole (GHSA-mwf2-3pr3-8698). Fix: Update that package to its patched version.
  • Worth fixing GHSA-pmv8-rq9r-6j72 Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
    package-lock.json
    A package you depend on has a known security hole (GHSA-pmv8-rq9r-6j72). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-13676 fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization
    package-lock.json
    A package you depend on has a known security hole (CVE-2026-13676). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-16221 Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x ...
    package-lock.json
    A package you depend on has a known security hole (CVE-2026-16221). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-18446 fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority
    package-lock.json
    A package you depend on has a known security hole (CVE-2026-18446). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-12143 form-data: form-data: Form field override via CRLF injection
    package-lock.json
    A package you depend on has a known security hole (CVE-2026-12143). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-54290 hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard
    package-lock.json
    A package you depend on has a known security hole (CVE-2026-54290). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-54286 hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
    package-lock.json
    A package you depend on has a known security hole (CVE-2026-54286). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-54287 hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice
    package-lock.json
    A package you depend on has a known security hole (CVE-2026-54287). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-54288 hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`
    package-lock.json
    A package you depend on has a known security hole (CVE-2026-54288). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-54289 hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest
    package-lock.json
    A package you depend on has a known security hole (CVE-2026-54289). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-59895 hono: Hono: Arbitrary markup injection via improper handling of class names in server-side rendering.
    package-lock.json
    A package you depend on has a known security hole (CVE-2026-59895). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-59896 hono: Hono: Information disclosure due to improper context isolation in server-side rendering
    package-lock.json
    A package you depend on has a known security hole (CVE-2026-59896). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-59897 hono: Hono: Information disclosure due to incorrect header de-duplication in AWS API Gateway v1 adapter
    package-lock.json
    A package you depend on has a known security hole (CVE-2026-59897). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-69207 Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
    package-lock.json
    A package you depend on has a known security hole (CVE-2026-69207). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-71848 Hono: Algorithmic Complexity DoS in Language Middleware
    package-lock.json
    A package you depend on has a known security hole (CVE-2026-71848). Fix: Update that package to its patched version.
… 6 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scanner 31 found

Your dependencies cross-checked against the OSV vulnerability database.

  • Worth fixing GHSA-frvp-7c67-39w9 Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-42h9-826w-cgv3 Axios: Excessive recursion in formDataToJSON can cause denial of service
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-67313). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7q8q-rj6j-mhjq Axios: Nested axios option objects can consume polluted prototype values
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-67319). Fix: Update that package to its patched version.
  • Worth fixing GHSA-f4gw-2p7v-4548 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-67315). Fix: Update that package to its patched version.
  • Worth fixing GHSA-gcfj-64vw-6mp9 Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-67320). Fix: Update that package to its patched version.
  • Worth fixing GHSA-hcpx-6fm6-wx23 Axios form serializer maxDepth bypass via {} metatoken
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-67321). Fix: Update that package to its patched version.
  • Worth fixing GHSA-jqh4-m9w3-8hp9 Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-67317). Fix: Update that package to its patched version.
  • Worth fixing GHSA-mmx7-hfxf-jppx Axios: Prototype pollution gadgets can alter axios request construction
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-67316). Fix: Update that package to its patched version.
  • Worth fixing GHSA-mwf2-3pr3-8698 Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-67318). Fix: Update that package to its patched version.
  • Worth fixing GHSA-pmv8-rq9r-6j72 Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-67312). Fix: Update that package to its patched version.
  • Worth fixing GHSA-xj6q-8x83-jv6g Axios: Prototype pollution auth subfields can inject Basic auth
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-67314). Fix: Update that package to its patched version.
  • Worth fixing GHSA-4c8g-83qw-93j6 fast-uri vulnerable to host confusion via failed IDN canonicalization
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-13676). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7p8r-x3mc-p8w7 fast-uri vulnerable to host confusion via backslash authority introducer
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-18446). Fix: Update that package to its patched version.
  • Worth fixing GHSA-v2hh-gcrm-f6hx fast-uri vulnerable to host confusion via literal backslash authority delimiter
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-16221). Fix: Update that package to its patched version.
  • Worth fixing GHSA-hmw2-7cc7-3qxx form-data: CRLF injection in form-data via unescaped multipart field names and filenames
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-12143). Fix: Update that package to its patched version.
  • Worth fixing GHSA-54fx-42gc-7vw4 Hono: Algorithmic Complexity DoS in Language Middleware
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-71848). Fix: Update that package to its patched version.
  • Worth fixing GHSA-88fw-hqm2-52qc hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-54290). Fix: Update that package to its patched version.
  • Worth fixing GHSA-8j4g-w8fx-2239 Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-69207). Fix: Update that package to its patched version.
  • Worth fixing GHSA-f23p-vx2j-j53r Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-71850). Fix: Update that package to its patched version.
  • Worth fixing GHSA-hvrm-45r6-mjfj hono/jsx does not isolate context per request, leading to cross-request data disclosure
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-59896). Fix: Update that package to its patched version.
  • Worth fixing GHSA-j6c9-x7qj-28xf hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-54287). Fix: Update that package to its patched version.
  • Worth fixing GHSA-rv63-4mwf-qqc2 hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-54288). Fix: Update that package to its patched version.
  • Worth fixing GHSA-w62v-xxxg-mg59 Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-59895). Fix: Update that package to its patched version.
  • Worth fixing GHSA-wgpf-jwqj-8h8p hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-54289). Fix: Update that package to its patched version.
  • Worth fixing GHSA-wwfh-h76j-fc44 hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
    /workdirs/scan-061a32a1-e4a1-459a-ae00-1bfa6923fb0f/package-lock.json
    A package you depend on has a known security hole (CVE-2026-54286). Fix: Update that package to its patched version.
… 6 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrep none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddog none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecard didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.