CVE-2026-24472: hono
Vulnerability summary
CVE-2026-24472 is a medium (CVSS 5.3) vulnerability in hono. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 27-01-2026PublishedVulnerability first disclosed.
- 27-01-2026Last modifiedVulnerability information updated.
Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Middleware contains an information disclosure vulnerability caused by improper handling of HTTP cache control directives. The middleware does not respect standard cache control headers such as `Cache-Control: private` or `Cache-Control: no-store`, which may result in private or authenticated responses being cached and subsequently exposed to unauthorized users. Version 4.11.7 has a patch for the issue.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · WolfiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · NpmEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.51%
Chance of exploitation in the next 30 days
Percentile
42%
Versus all other CVEs
30-day change
+0.03 pp
From 0.47% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-524Use of Cache Containing Sensitive InformationThe code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
- CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Affected systems
Chainguard10 products
- honoAll versions (No fix recorded)
- hono-adapter-mqttAll versions (No fix recorded)
- hono-cliAll versions (No fix recorded)
- hono-compatAll versions (No fix recorded)
- hono-service-authAll versions (No fix recorded)
Hono1 product
- hono< 4.11.7
Honojs1 product
- hono< 4.11.7
Npm1 product
- hono< 4.11.7
Wolfi1 product
- langfuse-3-worker< 3.153.0-r0
5 vendors · 14 products
References
6 links- github.com/honojs/hono/security/advisories/GHSA-6wqw-2p9w-4vw4X Refsource CONFIRMAdvisoryWEBVendor Advisory
- github.com/honojs/honoPACKAGE