CVE-2026-84365 honojs CVE debrief

Who should care

Developers using Hono for static site generation, especially those generating sites from user-submitted or uncontrolled route parameter values, should review and apply the patched version to prevent potential file system manipulation. Additionally, operators and security teams responsible for managing and securing Hono applications should be aware of the vulnerability and ensure that appropriate measures are taken to protect against potential attacks. Vulnerability management and security teams should prioritize reviewing and updating affected deployments, and consider implementing compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

The Hono framework's static site generation feature is vulnerable to path traversal attacks when using route parameters. An attacker could create or overwrite files outside the configured output directory by providing specially crafted parameter values. This issue arises when an application generates a static site from route parameter values it does not fully control, such as slugs from a CMS, API, or user submission. The vulnerability affects build-time static site generation only; request-time routing and applications with entirely developer-controlled ssgParams values are not affected. The fix in Hono version 4.13.5 addresses these issues by properly handling consecutive parent-directory segments in route parameters during static site generation.

Defensive priority

Medium-priority defensive review recommended due to potential for path traversal attacks during static site generation.

Recommended defensive actions

• Review and apply Hono version 4.13.5 or later for patched static site generation functionality.
• Verify output directory configurations for static site generation builds.
• Monitor build environments for unexpected file creations or modifications.
• Implement compensating controls for build-time security, such as validating route parameter inputs.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The evidence from official CVE and NVD sources indicates a path traversal vulnerability in Hono versions 4.12.12 to 4.13.4. The fix in 4.13.5 addresses issues with consecutive parent-directory segments in route parameters during static site generation. To verify, defenders should review the output directory configurations for static site generation builds, monitor build environments for unexpected file creations or modifications, and implement compensating controls for build-time security, such as validating route parameter inputs.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.