PT-2026-31282 · Hono · Hono

Published 2026-04-08 · Updated 2026-05-18 · CVE-2026-39408

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.12

Description A path traversal issue in the toSSG() function allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via ssgParams, specially crafted values can cause generated file paths to escape the intended output directory. The static site generation process creates output files based on route paths derived from application routes and parameters. If the ssgParams values contain traversal sequences (e.g., ..), the resulting output path may resolve outside the configured output directory, potentially overwriting unintended files, affecting generated artifacts, or impacting deployment outputs.

Recommendations Update to version 4.12.12 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CLEANSTART-2026-BE61221

CVE-2026-39408

GHSA-XF4J-XP2R-RQQX

Affected Products

Hono

References · 174

• https://github.com/honojs/hono/commit/b470278920fffcfd6d76002755d6db53db827679 · Patch
• https://github.com/honojs/hono/security/advisories/GHSA-xf4j-xp2r-rqqx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42036 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44459 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42035 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-6322 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42338 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-30827 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44455 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-69873 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-BE61221 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4926 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39408 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-35213 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41239 · Security Note