CVE-2026-24473: hono
Vulnerability summary
CVE-2026-24473 is a medium (CVSS 6.3) vulnerability in hono. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 27-01-2026PublishedVulnerability first disclosed.
- 27-01-2026Last modifiedVulnerability information updated.
Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Serve static Middleware for the Cloudflare Workers adapter contains an information disclosure vulnerability that may allow attackers to read arbitrary keys from the Workers environment. Improper validation of user-controlled paths can result in unintended access to internal asset keys. Version 4.11.7 contains a patch for the issue.
CVSS metrics
7 scores · 5 sources · 2 versions- OSV · WolfiEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- OSV · NpmEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- NVDNIST6.3MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.47%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
+0.03 pp
From 0.44% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-668Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Affected systems
Chainguard10 products
- honoAll versions (No fix recorded)
- hono-adapter-mqttAll versions (No fix recorded)
- hono-cliAll versions (No fix recorded)
- hono-compatAll versions (No fix recorded)
- hono-service-authAll versions (No fix recorded)
Hono1 product
- hono< 4.11.7
Honojs1 product
- hono< 4.11.7
Npm1 product
- hono< 4.11.7
Wolfi1 product
- langfuse-3-worker< 3.153.0-r0
5 vendors · 14 products
References
6 links- github.com/honojs/hono/security/advisories/GHSA-w332-q679-j88pX Refsource CONFIRMAdvisoryWEBVendor Advisory
- github.com/honojs/honoPACKAGE