CompatHub
Check EOL

Package compatibility

Hono 2.2

What Node.js versions does this Hono version support?

Compatibility is derived from the declared Node.js version requirement (npm engines.node). CompatHub does not independently test every combination.

Declared Node.js requirement

engines.node
>=16.0.0
Tip version
2.7.8
Source
npm Registry (engines.node)

Node.js compatibility matrix

Evaluated against CompatHub Node.js VersionLines. Compatibility and lifecycle status are separate signals.

Other Hono lines

Security

Advisories affecting Hono 2.2 (OSV.dev evidence). Known exploited status, due dates, and ransomware use from CISA KEV when matched.

Known vulnerabilities
15
Known exploited
0
Highest CVSS
—
  • CVE-2026-69207GHSA-8j4g-w8fx-2239

    Hono: ReDoS in CORS middleware via Access-Control-Request-Headers

    Affected:
    <4.12.34
    Fixed in:
    4.12.34
    Source:
    OSV source
  • CVE-2026-54288GHSA-rv63-4mwf-qqc2

    hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`

    Affected:
    <4.12.25
    Fixed in:
    4.12.25
    Source:
    OSV source · Advisory
  • CVE-2026-54289GHSA-wgpf-jwqj-8h8p

    hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

    Affected:
    <4.12.25
    Fixed in:
    4.12.25
    Source:
    OSV source · Advisory
  • CVE-2026-54290GHSA-88fw-hqm2-52qc

    hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard

    Affected:
    <4.12.25
    Fixed in:
    4.12.25
    Source:
    OSV source · Advisory
  • CVE-2026-54286GHSA-wwfh-h76j-fc44

    hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

    Affected:
    <4.12.25
    Fixed in:
    4.12.25
    Source:
    OSV source · Advisory
  • CVE-2026-54287GHSA-j6c9-x7qj-28xf

    hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice

    Affected:
    <4.12.25
    Fixed in:
    4.12.25
    Source:
    OSV source · Advisory
  • CVE-2026-47676GHSA-2gcr-mfcq-wcc3

    Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

    Affected:
    <4.12.21
    Fixed in:
    4.12.21
    Source:
    OSV source · Advisory
  • CVE-2026-47674GHSA-xrhx-7g5j-rcj5

    Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

    Affected:
    <4.12.21
    Fixed in:
    4.12.21
    Source:
    OSV source · Advisory
  • CVE-2026-47675GHSA-3hrh-pfw6-9m5x

    Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

    Affected:
    <4.12.21
    Fixed in:
    4.12.21
    Source:
    OSV source · Advisory
  • CVE-2026-47673GHSA-f577-qrjj-4474

    Hono: JWT middleware accepts any Authorization scheme, not only Bearer

    Affected:
    <4.12.21
    Fixed in:
    4.12.21
    Source:
    OSV source · Advisory
  • CVE-2026-44458GHSA-qp7p-654g-cw7p

    Hono has CSS Declaration Injection via Style Object Values in JSX SSR

    Affected:
    <4.12.18
    Fixed in:
    4.12.18
    Source:
    OSV source
  • CVE-2026-44459GHSA-hm8q-7f3q-5f36

    Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

    Affected:
    <4.12.18
    Fixed in:
    4.12.18
    Source:
    OSV source · Advisory
  • CVE-2026-44457GHSA-p77w-8qqv-26rm

    Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

    Affected:
    <4.12.18
    Fixed in:
    4.12.18
    Source:
    OSV source · Advisory
  • CVE-2026-44456GHSA-9vqf-7f2p-gf9v

    Hono: bodyLimit() can be bypassed for chunked / unknown-length requests

    Affected:
    <4.12.16
    Fixed in:
    4.12.16
    Source:
    OSV source · Advisory
  • CVE-2026-44455GHSA-69xw-7hcm-h432

    hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection

    Affected:
    <4.12.16
    Fixed in:
    4.12.16
    Source:
    OSV source · Advisory