Hono CVE-2026-84365

Exploitation requires all of the following simultaneously: (1) the application uses Hono's toSSG() static site generator - request-time routing is not affected in any Hono version; (2) ssgParams values are sourced from an untrusted external input such as a CMS content API, external feed, or user submission, rather than being hardcoded or fully validated by the developer; and (3) a developer or automated CI/CD process actively runs the SSG build with those ssgParams. Applications in which all ssgParams values are under developer control are explicitly not vulnerable regardless of Hono version. The attack is limited to the build environment filesystem - production impact occurs only if compromised artifacts are subsequently deployed. Windows-hosted build environments face additional bypass vectors via drive-relative (C:path) and absolute (C:\Windows\) path injection.

The CVSS 6.5 score (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) accurately reflects moderate real-world risk. UI:R captures the prerequisite that a developer or automated CI/CD process must run the SSG build - this is an active step rather than passive receipt of network traffic, meaningfully limiting opportunistic exploitation. The high integrity impact (I:H) is well-grounded: arbitrary file writes outside the output directory can corrupt deployment artifacts, configuration files, or CI scripts, and if poisoned artifacts are subsequently deployed to production the secondary impact escalates significantly. However, exploitation requires a specific deployment pattern: toSSG() must be used with ssgParams values drawn from an untrusted external source; applications with fully developer-controlled ssgParams are explicitly excluded by the advisory. The vulnerability is a second-order bypass of CVE-2026-39408, indicating the original patch normalization logic was insufficiently audited for consecutive-segment and Windows-path edge cases. EPSS data is absent from the provided input and cannot be assessed. KEV listing is not confirmed. Real-world risk is highest in CI/CD pipelines that pull CMS or user-submitted route slugs directly into SSG builds without prior sanitization.

An attacker who can influence content in a CMS or external API used as a slug source submits a route parameter value such as 'a/b/../../../deploy-config.json'. When a developer or CI/CD pipeline runs the SSG build, toSSG() constructs a file path from this value, the incomplete normalization check accepts the traversal as within the output directory, and the rendered page content is written to the resolved path outside the build output - potentially overwriting deployment scripts, web server configuration, or other CI artifacts. If the overwritten artifact is subsequently deployed to production, the attacker achieves indirect code execution or configuration tampering. No public POC exploit code exists beyond the test cases present in the fix commit.