SB2026072461 - Multiple vulnerabilities in hono
Published: July 24, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Cross-site scripting (CVE-ID: CVE-2026-24771)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.
The vulnerability exists due to cross-site scripting in the ErrorBoundary component when rendering untrusted user-controlled strings as raw HTML. A remote attacker can supply crafted input that is reflected in rendered content to execute arbitrary script in the victim's browser.
User interaction is required, and the issue is only exploitable when an application renders untrusted user input within ErrorBoundary.
2) Improper access control (CVE-ID: CVE-2026-24473)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper access control in serve-static middleware for the Cloudflare Workers adapter when handling user-controlled request paths for static assets. A remote attacker can send a specially crafted request to disclose sensitive information.
Only applications running on Cloudflare Workers that use the serve-static middleware with user-controllable request paths are vulnerable.
3) Input validation error (CVE-ID: CVE-2026-24398)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass IP-based access controls.
The vulnerability exists due to improper input validation in the IP Restriction Middleware and src/utils/ipaddr.ts when processing client-provided IP addresses for access control decisions. A remote attacker can send a malformed IP address to bypass IP-based access controls.
This is exploitable when the application relies on client-provided IP addresses such as the X-Forwarded-For header for access control decisions.
4) Use of cache containing sensitive information (CVE-ID: CVE-2026-24472)
CWE-ID: CWE-524 - Use of Cache Containing Sensitive Information
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to use of cache containing sensitive information in Cache Middleware when handling responses marked with cache control directives such as Cache-Control: private or Cache-Control: no-store. A remote attacker can send a request to an affected endpoint to disclose sensitive information.
Applications running on Deno, Bun, and Node.js that rely on the middleware to enforce HTTP cache control semantics are affected, and exploitation may occur after an authenticated user's response is cached and later served to an unauthenticated request.
Remediation
Install update from vendor's website.