Information Disclosure Vulnerability in Hono Web Application Framework

CVE-2026-24472

What is CVE-2026-24472?

The Hono web application framework, prior to version 4.11.7, contains a vulnerability related to improper management of HTTP cache control directives in its Cache Middleware. This flaw arises when standard cache control headers like 'Cache-Control: private' or 'Cache-Control: no-store' are not honored. Consequently, sensitive responses intended for private or authenticated users may be stored in the cache, making them vulnerable to unauthorized access. To mitigate this risk, users are advised to upgrade to version 4.11.7 where a patch has been implemented.

References