← Vulnerability feed

Vulnerability record · CVE-2025-58362 · published 5 September 2025

CVE-2025-58362: Hono vulnerability

Hono · Hono

Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility function which could allow path confusion and potential bypass of proxy-level ACLs (e.g. Nginx location blocks). The original implementation relied on fixed character offsets when parsing request URLs. Under certain malformed absolute-form Request-URIs, this could lead to incorrect path extraction depending on the application and environment. If proxy ACLs are used to protect sensitive endpoints such as /admin, this flaw could have allowed unauthorized access. The confidentiality impact depends on what data is exposed: if sensitive administrative data is exposed, the impact may be high, otherwise it may be moderate. This issue is fixed in version 4.9.6.

7.5 CVSS 3.1 High EPSS 0.53% · top 57.2% CWE-706 · CWE-706
7.5CVSS 3.1 base score
0.53%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility function which could allow path confusion and potential bypass of proxy-level ACLs (e.g. Nginx location blocks). The original implementation relied on fixed character offsets when parsing request URLs. Under certain malformed absolute-form Request-URIs, this could lead to incorrect path extraction depending on the application and environment. If proxy ACLs are used to protect sensitive endpoints such as /admin, this flaw could have allowed unauthorized access. The confidentiality impact depends on what data is exposed: if sensitive administrative data is exposed, the impact may be high, otherwise it may be moderate. This issue is fixed in version 4.9.6.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/honojs/hono/commit/1d79aedc3f82d8c9969b115fe61bc4bd705ec8de Patch
https://github.com/honojs/hono/releases/tag/v4.9.6 Release Notes
https://github.com/honojs/hono/security/advisories/GHSA-9hp6-4448-45g2 Vendor Advisory

Track CVE-2025-58362 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-29045Hono vulnerabilityHono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with r…EPSS 0.60%8.1CVE-2025-62610Hono improper authorization vulnerabilityHono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middle…EPSS 0.38%7.5CVE-2026-27700Hono authentication bypass by spoofing vulnerabilityHono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapte…EPSS 0.34%6.5CVE-2026-59896Hono race condition vulnerabilityHono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context va…EPSS 0.30%6.5CVE-2026-47673Hono improper authorization vulnerabilityHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify tha…EPSS 0.25%6.5CVE-2026-44456Hono uncontrolled resource consumption vulnerabilityHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize…EPSS 0.28%6.5CVE-2026-29085Hono injection vulnerabilityHono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using streamSSE() in Streaming He…EPSS 0.29%6.5CVE-2026-24398Hono vulnerabilityHono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, IP Restriction Middleware in Hono is v…EPSS 0.35%

Source: NIST National Vulnerability Database (record CVE-2025-58362), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.