Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-9xtz-up2w-mqdh
Vulnerability ID VCID-9xtz-up2w-mqdh
Aliases CVE-2026-39407
GHSA-wmmm-f939-6g9c
Summary Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in 4.12.12.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2026-39407
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-wmmm-f939-6g9c
cvssv3.1 5.3 https://github.com/honojs/hono
generic_textual MODERATE https://github.com/honojs/hono
cvssv3.1 5.3 https://github.com/honojs/hono/commit/9aff14bd727f8b0435c963363fd803260e7b8e3c
generic_textual MODERATE https://github.com/honojs/hono/commit/9aff14bd727f8b0435c963363fd803260e7b8e3c
ssvc Track https://github.com/honojs/hono/commit/9aff14bd727f8b0435c963363fd803260e7b8e3c
cvssv3.1 5.3 https://github.com/honojs/hono/releases/tag/v4.12.12
generic_textual MODERATE https://github.com/honojs/hono/releases/tag/v4.12.12
ssvc Track https://github.com/honojs/hono/releases/tag/v4.12.12
cvssv3.1 5.3 https://github.com/honojs/hono/security/advisories/GHSA-wmmm-f939-6g9c
cvssv3.1_qr MODERATE https://github.com/honojs/hono/security/advisories/GHSA-wmmm-f939-6g9c
generic_textual MODERATE https://github.com/honojs/hono/security/advisories/GHSA-wmmm-f939-6g9c
ssvc Track https://github.com/honojs/hono/security/advisories/GHSA-wmmm-f939-6g9c
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2026-39407
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-39407
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-39407
https://github.com/honojs/hono
https://nvd.nist.gov/vuln/detail/CVE-2026-39407
9aff14bd727f8b0435c963363fd803260e7b8e3c https://github.com/honojs/hono/commit/9aff14bd727f8b0435c963363fd803260e7b8e3c
GHSA-wmmm-f939-6g9c https://github.com/advisories/GHSA-wmmm-f939-6g9c
GHSA-wmmm-f939-6g9c https://github.com/honojs/hono/security/advisories/GHSA-wmmm-f939-6g9c
v4.12.12 https://github.com/honojs/hono/releases/tag/v4.12.12
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/honojs/hono
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/honojs/hono/commit/9aff14bd727f8b0435c963363fd803260e7b8e3c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-08T16:04:53Z/ Found at https://github.com/honojs/hono/commit/9aff14bd727f8b0435c963363fd803260e7b8e3c
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/honojs/hono/releases/tag/v4.12.12
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-08T16:04:53Z/ Found at https://github.com/honojs/hono/releases/tag/v4.12.12
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/honojs/hono/security/advisories/GHSA-wmmm-f939-6g9c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-08T16:04:53Z/ Found at https://github.com/honojs/hono/security/advisories/GHSA-wmmm-f939-6g9c
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-39407
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.06246
EPSS Score 0.00021
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:46:02.989795+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/39xxx/CVE-2026-39407.json 38.6.0