PT-2026-5012 · Hono · Hono

Simonkoeck · Published 2026-01-27 · Updated 2026-02-04 · CVE-2026-24472

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.11.7

Description The Cache Middleware component does not properly handle HTTP cache control directives such as Cache-Control: private or Cache-Control: no-store. This can lead to private or authenticated responses being cached and exposed to unauthorized users. The vulnerability exists in the cache decision logic of the Cache Middleware. The impact of this issue is Web Cache Deception and information disclosure, potentially exposing personally identifiable information or session-related data. The issue affects applications using the hono/cache middleware and relying on it to correctly honor HTTP cache control directives.

Recommendations Update to version 4.11.7 or later.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

CWE-524

Related Identifiers

CVE-2026-24472

GHSA-6WQW-2P9W-4VW4

Affected Products

Hono

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24472.json · Exploit
• https://github.com/honojs/hono/security/advisories/GHSA-6wqw-2p9w-4vw4 · Vendor Advisory
• https://github.com/honojs/hono/commit/12c511745b3f1e7a3f863a23ce5f921c7fa805d1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-24472 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24472 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6wqw-2p9w-4vw4 · Vendor Advisory
• https://github.com/honojs/hono · Note
• https://github.com/honojs/hono/releases/tag/v4.11.7 · Note
• https://t.me/cveNotify/150864 · Telegram Post
• https://twitter.com/_cvereports/status/2016272666152358108 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2016391926207955339 · Twitter Post