Use of cache containing sensitive information in hono - CVE-2026-24472

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of cache containing sensitive information in Cache Middleware when handling responses marked with cache control directives such as Cache-Control: private or Cache-Control: no-store. A remote attacker can send a request to an affected endpoint to disclose sensitive information.

Applications running on Deno, Bun, and Node.js that rely on the middleware to enforce HTTP cache control semantics are affected, and exploitation may occur after an authenticated user's response is cached and later served to an unauthenticated request.

Affected software

How to mitigate CVE-2026-24472

External References

• https://github.com/honojs/hono/security/advisories/GHSA-6wqw-2p9w-4vw4

Related Security Bulletins

• Multiple vulnerabilities in hono