CVE-2026-84365

Received Received - Intake

Path Traversal in Hono Framework Static Site Generation

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG() can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments. Static site generation builds each output path from the route path and values supplied through ssgParams, then verifies that the result stays inside the output directory using the same normalization routine that built the path. That routine does not fully collapse runs of consecutive parent-directory segments, allowing a path that the check accepts to resolve outside the output directory, and the check also treats output directories that differ in how they are rooted as equivalent. This arises when an application generates a static site from route parameter values it does not fully control, such as slugs from a CMS, API, or user submission. An untrusted ssgParams value can create or overwrite files elsewhere in the build environment and alter generated artifacts or deployment output. The vulnerability affects build-time static site generation only; request-time routing and applications with entirely developer-controlled ssgParams values are not affected. This issue is fixed in version 4.13.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-84365

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability in Hono, a JavaScript web framework, allows file traversal attacks during static site generation (SSG). When route parameters contain consecutive parent-directory segments (like ../), the path normalization fails to fully collapse them, letting the framework write files outside the intended output directory. This happens if the application uses untrusted ssgParams values, such as slugs from a CMS or user input.

Detection Guidance

This vulnerability affects Hono versions 4.12.12 to 4.13.4 during static site generation (SSG). To detect it, check your Hono version with: npm list hono. If the version is within the vulnerable range, update to 4.13.5 or later. Inspect build logs for SSG processes using untrusted route parameters or ssgParams values.

Impact Analysis

An attacker could exploit this to create or overwrite files in your build environment or deployment output. This might alter generated artifacts, disrupt deployments, or lead to unintended file modifications. Only applications using untrusted ssgParams for SSG are affected; request-time routing and developer-controlled parameters are safe.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized file creation or modification outside the intended output directory during static site generation. If exploited, it may lead to unauthorized data exposure or integrity issues, which are critical concerns under these regulations.

Mitigation Strategies

Upgrade Hono to version 4.13.5 or later to address the vulnerability. Ensure route parameters and ssgParams values are fully controlled or sanitized to prevent path traversal sequences.

Hi! I’m here to help you understand CVE-2026-84365. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70