Hono CVE-2026-24473
MEDIUM
GHSA-w332-q679-j88p
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3Blast Radius
ecosystem impact- 73 npm packages depend on hono (62 direct, 11 indirect)
Ecosystem-wide dependent count for version 4.11.7.
DescriptionNVD
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Serve static Middleware for the Cloudflare Workers adapter contains an information disclosure vulnerability that may allow attackers to read arbitrary keys from the Workers environment. Improper validation of user-controlled paths can result in unintended access to internal asset keys. Version 4.11.7 contains a patch for the issue.
AnalysisAI
Hono versions before 4.11.7 contain an information disclosure vulnerability in the static file serving middleware for Cloudflare Workers that allows unauthenticated remote attackers to read sensitive environment keys through path traversal. The lack of proper input validation enables attackers to access internal asset keys that should remain protected. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today