Recent Advisories

Severity ID Title Vendor Product Date Type
MEDIUM 4.8 CVE-2026-54289

Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest_CVE-2026-54289

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a r...

honojs hono < 4.12.25 CVE
MEDIUM 5.3 CVE-2026-54287

Hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice_CVE-2026-54287

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda, the ALB single-header respon...

honojs hono < 4.12.25 CVE
MEDIUM 5.9 CVE-2026-54286

Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)_CVE-2026-54286

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C...

honojs hono < 4.12.25 CVE
MEDIUM 5.3 CVE-2026-54285

opentelemetry-js: Unbounded memory allocation in W3C Baggage propagation_CVE-2026-54285

opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce siz...

open-telemetry opentelemetry-js < 2.8.0 CVE
MEDIUM 6.6 CVE-2026-54278

AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup_CVE-2026-54278

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed req...

aio-libs aiohttp < 3.14.1 CVE
MEDIUM 6.6 CVE-2026-54277

AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines_CVE-2026-54277

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check i...

aio-libs aiohttp < 3.14.1 CVE
MEDIUM 6.3 CVE-2026-54276

AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges_CVE-2026-54276

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication re...

aio-libs aiohttp < 3.14.1 CVE
MEDIUM 6.6 CVE-2026-54274

AIOHTTP: Incomplete websocket frame payloads bypass memory limits_CVE-2026-54274

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket fr...

aio-libs aiohttp < 3.14.1 CVE
MEDIUM 6.6 CVE-2026-54273

AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit_CVE-2026-54273

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined re...

aio-libs aiohttp < 3.14.1 CVE
MEDIUM 5.3 CVE-2026-54270

protobufjs: Memory amplification from preserved unknown fields in binary decode_CVE-2026-54270

protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 to 8.4.2, protobufjs preserved unknown wire elements in message...

protobufjs protobuf.js >=8.2.0, < 8.5.0 CVE