runtime-1.0.0-beta.9.tgz: 5 vulnerabilities (highest severity is: 7.5)

[mend-for-github-com]

Vulnerable Library - runtime-1.0.0-beta.9.tgz

Sample Path to Dependency File: /tutorials/voice_ai_flue-javascript-workshop/project/package.json

Path to vulnerable library: /tutorials/voice_ai_flue-javascript-workshop/project/package.json

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (runtime version)	Remediation Possible**
CVE-2026-18446	High	7.5	fast-uri-3.1.4.tgz	Transitive	N/A*	❌
CVE-2026-71848	Medium	5.3	hono-4.12.32.tgz	Transitive	N/A*	❌
CVE-2026-69207	Medium	5.3	hono-4.12.32.tgz	Transitive	N/A*	❌
CVE-2026-71850	Medium	4.8	hono-4.12.32.tgz	Transitive	N/A*	❌
CVE-2026-71849	Low	3.7	hono-4.12.32.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-18446

Vulnerable Library - fast-uri-3.1.4.tgz

Dependency-free RFC 3986 URI toolbox

Library home page: https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz

Sample Path to Dependency File: /tutorials/voice_ai_flue-javascript-workshop/project/package.json

Path to vulnerable library: /tutorials/voice_ai_flue-javascript-workshop/project/package.json

Dependency Hierarchy:

• runtime-1.0.0-beta.9.tgz (Root Library)
  • sdk-1.30.0.tgz
    • ajv-8.20.0.tgz
      • ❌ fast-uri-3.1.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applications that use fast-uri to enforce host based policy such as allowlists, SSRF filtering, or redirect validation before passing the same URL into Node's URL or fetch consumers can be steered to an unintended host. Upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4.

Publish Date: 2026-07-31

URL: CVE-2026-18446

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-7p8r-x3mc-p8w7

Release Date: 2026-07-31

Fix Resolution: fast-uri - 2.4.4,fast-uri - 3.1.5,fast-uri - 4.1.2,https://github.com/fastify/fast-uri.git - v3.1.5,https://github.com/fastify/fast-uri.git - v4.1.2,https://github.com/fastify/fast-uri.git - v2.4.4

CVE-2026-71848

Vulnerable Library - hono-4.12.32.tgz

Web framework built on Web Standards

Library home page: https://registry.npmjs.org/hono/-/hono-4.12.32.tgz

Sample Path to Dependency File: /tutorials/voice_ai_flue-javascript-workshop/project/package.json

Path to vulnerable library: /tutorials/voice_ai_flue-javascript-workshop/project/package.json

Dependency Hierarchy:

• runtime-1.0.0-beta.9.tgz (Root Library)
  • ❌ hono-4.12.32.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the languageDetector middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags. To implement progressive language tag truncation, normalizeLanguage() repeatedly calls parts.slice(0, i).join('-') for every possible prefix, so the total amount of string processing grows quadratically with the number of subtags. Language values may come from a query parameter, cookie, Accept-Language header, or URL path, depending on the detector configuration, and the default detector order enables query string, cookie, and header detection, so applications using languageDetector() may expose this processing to unauthenticated requests. An attacker may repeatedly send requests containing long, hyphen separated language tags, causing excessive CPU consumption and preventing unrelated requests from being processed. This issue is fixed in version 4.12.34.

Publish Date: 2026-08-07

URL: CVE-2026-71848

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-54fx-42gc-7vw4

Release Date: 2026-08-07

Fix Resolution: hono - 4.12.34,https://github.com/honojs/hono.git - v4.12.34

CVE-2026-69207

Vulnerable Library - hono-4.12.32.tgz

Web framework built on Web Standards

Library home page: https://registry.npmjs.org/hono/-/hono-4.12.32.tgz

Sample Path to Dependency File: /tutorials/voice_ai_flue-javascript-workshop/project/package.json

Path to vulnerable library: /tutorials/voice_ai_flue-javascript-workshop/project/package.json

Dependency Hierarchy:

• runtime-1.0.0-beta.9.tgz (Root Library)
  • ❌ hono-4.12.32.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in CORS middleware, hono/cors, is vulnerable to a regular expression denial of service (ReDoS). During a preflight OPTIONS request, the middleware parses the attacker-controlled Access-Control-Request-Headers header using a whitespace-tolerant regular expression whose backtracking makes its running time quadratic in the input length. Because the header value is bounded only by the deployment's maximum HTTP header size, a single preflight carrying a long run of whitespace can consume seconds of CPU and block request processing. On runtimes that share one execution thread across requests, this stalls concurrent requests as well, and repeated requests can render the service unresponsive. This affects the default configuration, since the vulnerable path is reached whenever cors() is used with an unset or empty allowHeaders. Applications that set a non-empty allowHeaders are not affected. This issue is fixed in version 4.12.34.

Publish Date: 2026-08-07

URL: CVE-2026-69207

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-08-03

Fix Resolution: https://github.com/honojs/hono.git - v4.12.34

CVE-2026-71850

Vulnerable Library - hono-4.12.32.tgz

Web framework built on Web Standards

Library home page: https://registry.npmjs.org/hono/-/hono-4.12.32.tgz

Sample Path to Dependency File: /tutorials/voice_ai_flue-javascript-workshop/project/package.json

Path to vulnerable library: /tutorials/voice_ai_flue-javascript-workshop/project/package.json

Dependency Hierarchy:

• runtime-1.0.0-beta.9.tgz (Root Library)
  • ❌ hono-4.12.32.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo() from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and request scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request. Components wrapped with memo() are compared by props alone; values read implicitly during rendering, such as JSX Context through createContext() and useContext(), useRequestContext() from hono/jsx-renderer, and getContext() from hono/context-storage, do not participate, and the retained result lives as long as the wrapped component, so it outlives the request that produced it. A user may receive a response containing HTML rendered for another user when both render the same memoized component with comparator equal props on the same warm instance, which may disclose another user's account or profile data, disclose request scoped secrets embedded in HTML such as CSRF tokens, or expose role specific content to users who should not receive it. This issue is fixed in version 4.12.34.

Publish Date: 2026-08-07

URL: CVE-2026-71850

CVSS 3 Score Details (4.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-f23p-vx2j-j53r

Release Date: 2026-08-07

Fix Resolution: hono - 4.12.34,https://github.com/honojs/hono.git - v4.12.34

CVE-2026-71849

Vulnerable Library - hono-4.12.32.tgz

Web framework built on Web Standards

Library home page: https://registry.npmjs.org/hono/-/hono-4.12.32.tgz

Sample Path to Dependency File: /tutorials/voice_ai_flue-javascript-workshop/project/package.json

Path to vulnerable library: /tutorials/voice_ai_flue-javascript-workshop/project/package.json

Dependency Hierarchy:

• runtime-1.0.0-beta.9.tgz (Root Library)
  • ❌ hono-4.12.32.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy() function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header fields listed in a message's Connection header field before forwarding the message, in addition to the well known hop by hop headers, but the proxy() function only removed the well known hop by hop headers, including Connection itself, from origin responses. A client may therefore receive response headers that the origin intended only for its immediate peer, disclosing connection scoped or internal metadata contained in such headers, when an application proxies responses from an origin that declares additional, non standard headers as hop by hop via the Connection response header. This issue is fixed in version 4.12.34.

Publish Date: 2026-08-07

URL: CVE-2026-71849

CVSS 3 Score Details (3.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-79qm-7rj5-m7r9

Release Date: 2026-08-07

Fix Resolution: hono - 4.12.34,https://github.com/honojs/hono.git - v4.12.34

[mend-for-github-com]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-for-github-com]

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.