File Write Vulnerability in Hono Web Application Framework
CVE-2026-84365
6.5MEDIUM
What is CVE-2026-84365?
The Hono Web Application Framework, versions 4.12.12 to 4.13.5, contains a vulnerability that allows the toSSG() method to write files outside the configured output directory. This occurs when route parameters include consecutive parent-directory segments, which the framework's normalization routine fails to fully collapse. Consequently, untrusted values in ssgParams can cause files to be created or overwritten in unintended locations during the static site generation process. This vulnerability primarily impacts the build phase and does not affect request-time routing or usages where ssgParams are entirely controlled by developers. The issue has been addressed in version 4.13.5.
Affected Version(s)
hono < 4.13.5