cve.bz

CVE-2026-39408

5.9 mediumEPSS 0.5%

Medium (5.9) in hono hono. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in hono 4.12.12.

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via ssgParams, specially crafted values can cause generated file paths to escape the intended output directory. This vulnerability is fixed in 4.12.12.

Severity

CVSS 4.0

5.9 medium
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-11-01)
CWE
CWE-22
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-xf4j-xp2r-rqqxnpmhono>=4.0.0 <4.12.124.12.12

References

Check your stackJSON