Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
52 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
When using serveStatic with deno, it is possible to directory traverse where main.ts is located. My environment is configured as per this tutorial https://hono.dev/getting-started/deno PoC source request response is content of main.ts Impact Unexpected files are retrieved.
Recommended action: Upgrade to 4.2.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The clients may override named path parameter values from previous requests if the application is using TrieRouter. So, there is a risk that a privileged user may use unintended parameters when deleting REST API resources. TrieRouter is used either explicitly or when the application matches a pattern that is not supported by the default RegExpRouter. The code to reproduce it. The server side application: The client code which makes requests to the server application: The results: Patches "v3.11.7" includes the change to fix this issue. Workarounds Don't use TrieRouter directly. References Router options on the Hono website: https://hono.dev/api/hono#router-option
Recommended action: Upgrade to 3.11.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.