EUVD-2026-69612
GHSA-gqvv-2mrq-wpjv
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attacker supplies malicious slug via external CMS or API (AV:N, PR:N); developer must actively run the build (UI:R); only file integrity is impacted, not confidentiality or availability.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3Blast Radius
ecosystem impact- 93 npm packages depend on hono (44 direct, 50 indirect)
Ecosystem-wide dependent count for version 4.13.5.
DescriptionCVE.org
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG() can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments. Static site generation builds each output path from the route path and values supplied through ssgParams, then verifies that the result stays inside the output directory using the same normalization routine that built the path. That routine does not fully collapse runs of consecutive parent-directory segments, allowing a path that the check accepts to resolve outside the output directory, and the check also treats output directories that differ in how they are rooted as equivalent. This arises when an application generates a static site from route parameter values it does not fully control, such as slugs from a CMS, API, or user submission. An untrusted ssgParams value can create or overwrite files elsewhere in the build environment and alter generated artifacts or deployment output. The vulnerability affects build-time static site generation only; request-time routing and applications with entirely developer-controlled ssgParams values are not affected. This issue is fixed in version 4.13.5.
AnalysisAI
Path traversal in Hono's toSSG() static site generator allows untrusted ssgParams values - such as slugs sourced from a CMS, external API, or user submission - to create or overwrite files outside the configured output directory at build time. Versions 4.12.12 through 4.13.4 are affected; the root cause is an incomplete fix for CVE-2026-39408 that fails to collapse consecutive parent-directory segments (e.g., 'a/b/../../../') in route parameter values, and also mishandles Windows drive-relative and UNC path roots. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following simultaneously: (1) the application uses Hono's toSSG() static site generator - request-time routing is not affected in any Hono version; (2) ssgParams values are sourced from an untrusted external input such as a CMS content API, external feed, or user submission, rather than being hardcoded or fully validated by the developer; and (3) a developer or automated CI/CD process actively runs the SSG build with those ssgParams. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 score (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) accurately reflects moderate real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Hono to version 4.13.5 or later, available at https://github.com/honojs/hono/releases/tag/v4.13.5; this release corrects the normalization routine to fully collapse consecutive parent-directory segments and properly handle Windows drive-letter and UNC path roots. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The adapter @hono/node-server allows you to run your Hono application on Node.js. Rated high severity (CVSS 7.5), this v
Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery (CSRF) middleware by
Quadratic-complexity denial of service in Hono's `languageDetector` middleware (versions 4.12.0-4.12.33) allows unauthen
Hono is a Web application framework that provides support for any JavaScript runtime. Rated medium severity (CVSS 5.3),
@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Rated medium severity (CVSS 5.3),
Hono is a Web application framework that provides support for any JavaScript runtime. Rated medium severity (CVSS 5.0),
Cross-user HTML disclosure in Hono's server-side rendering affects all applications using hono/jsx with memo()-wrapped c
Hono is a web framework written in TypeScript. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploita
Hono is a Web application framework that provides support for any JavaScript runtime. [CVSS 8.2 HIGH]
Hono versions before 4.11.4 allow JWT algorithm confusion attacks through improper algorithm validation in the JWK/JWKS
Hono before version 4.11.4 contains a JWT algorithm confusion vulnerability in its JWK/JWKS verification middleware that
Hono's `proxy()` function in the `hono/proxy` Proxy Helper leaks connection-scoped response headers to downstream client
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today