SB2026072456 - Multiple vulnerabilities in hono

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072456

SB2026072456 - Multiple vulnerabilities in hono

Published: July 24, 2026

Security Bulletin ID SB2026072456
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Partial DoS

Breakdown by Severity

Medium 80% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Input validation error (CVE-ID: CVE-2026-39410)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to override sensitive cookies.

The vulnerability exists due to improper input validation in getCookie() cookie parsing when handling cookie names with a non-breaking space prefix. A remote attacker can set a specially crafted cookie to override sensitive cookies.

This issue affects applications that rely on getCookie() for security-sensitive cookie handling and may enable bypass of __Secure- and __Host- prefix protections.


2) HTTP response splitting (CVE-ID: CVE-2026-56762)

CWE-ID: CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper neutralization of CRLF sequences in HTTP headers in setCookie(), serialize(), and serializeSigned() when generating Set-Cookie headers with a user-controlled cookie name. A remote attacker can supply a crafted cookie name containing invalid characters to cause a denial of service.

In tested modern runtimes, malformed Set-Cookie headers are rejected before being sent, and the reported header injection behavior could not be reproduced.


3) Incorrect Behavior Order: Validate Before Canonicalize (CVE-ID: CVE-2026-39409)

CWE-ID: CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass IP-based access restrictions.

The vulnerability exists due to incorrect behavior order: validate before canonicalize in ipRestriction() when processing IPv4-mapped IPv6 client addresses against IPv4 allow or deny rules. A remote attacker can send requests from an IPv4 address represented as an IPv4-mapped IPv6 address to bypass IP-based access restrictions.

This issue occurs in dual-stack environments where IPv4 clients may be represented as IPv4-mapped IPv6 addresses.


4) Path traversal (CVE-ID: CVE-2026-39408)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to write files outside the intended output directory.

The vulnerability exists due to path traversal in toSSG() when constructing output file paths from dynamic route parameters provided via ssgParams. A remote attacker can supply specially crafted parameter values containing traversal sequences to write files outside the intended output directory.

This issue is limited to build-time static site generation and does not affect request-time routing.


5) Improper access control (CVE-ID: CVE-2026-39407)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in serveStatic when handling request paths containing repeated slashes. A remote attacker can send a specially crafted request path to disclose sensitive information.

This issue affects applications that rely on serveStatic together with route-based middleware for access control.


Remediation

Install update from vendor's website.

References