SB2026082832 - Multiple vulnerabilities in hono
Published: August 28, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Resource exhaustion (CVE-ID: N/A)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in parseBody() when processing request bodies with dot-notation enabled. A remote attacker can send specially crafted requests to cause a denial of service.
Only applications that explicitly enable dot-notation parsing are affected. Concurrent requests can exhaust the JavaScript heap and terminate the server process.
2) Path traversal (CVE-ID: N/A)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to overwrite files outside the intended output directory.
The vulnerability exists due to path traversal in the toSSG() static site generation function when processing route parameter values supplied through ssgParams during static site generation. A remote attacker can supply crafted route parameter values containing consecutive parent-directory segments to overwrite files outside the intended output directory.
This issue affects build-time static site generation only, and applications whose ssgParams values are entirely developer-controlled are not affected. User interaction is required to generate the static site from untrusted route parameter values.
3) Inconsistent interpretation of HTTP requests (CVE-ID: N/A)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass filtering or cache unsafe responses.
The vulnerability exists due to inconsistent interpretation of HTTP requests in the query parser and cache middleware when processing request targets containing a literal fragment followed by query parameters. A remote attacker can send a specially crafted request to bypass filtering or cache unsafe responses.
Only deployments where a literal # reaches the application are affected; runtimes or intermediaries that normalize or strip the fragment are not affected.
Remediation
Install update from vendor's website.