CVE-2026-84365 honojs CVE debrief

Who should care

Defenders who use the Hono web application framework for static site generation should assess their exposure and verify their application versions. They should also review their static site generation configurations to ensure that output directories are properly validated.

Why it matters

CVE-2026-84365 is a vulnerability in the Hono web application framework that allows an attacker to write files outside the configured output directory during static site generation. Defenders should prioritize verifying their Hono application versions and updating to 4.13.5 if necessary. They should also review their static site generation configurations to ensure that output directories are properly validated.

• An attacker can create or overwrite files elsewhere in the build environment
• Generated artifacts or deployment output can be altered
• Static site generation builds can be compromised
• Verification of output directory validation is necessary

Technical summary

The vulnerability is caused by a flaw in the toSSG() function, which does not fully collapse runs of consecutive parent-directory segments. This allows an attacker to create or overwrite files elsewhere in the build environment and alter generated artifacts or deployment output. The vulnerability affects build-time static site generation only; request-time routing and applications with entirely developer-controlled ssgParams values are not affected. Static site generation builds each output path from the route path and values supplied through ssgParams, then verifies that the result stays inside the output directory using the same normalization routine that built the path.

Defensive priority

Defenders should prioritize verifying their Hono application versions and updating to 4.13.5 if necessary. They should also review their static site generation configurations to ensure that output directories are properly validated.

Recommended defensive actions

• Verify Hono application version and update to 4.13.5 if necessary
• Review static site generation configurations to ensure proper output directory validation
• Monitor build environment for suspicious file creation or modification
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by a flaw in the toSSG() function, which does not fully collapse runs of consecutive parent-directory segments. This allows an attacker to create or overwrite files elsewhere in the build environment and alter generated artifacts or deployment output.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.