CVE-2025-58362

Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility function which could allow path confusion and potential bypass of proxy-level ACLs (e.g. Nginx location blocks). The original implementation relied on fixed character offsets when parsing request URLs. Under certain malformed absolute-form Request-URIs, this could lead to incorrect path extraction depending on the application and environment. If proxy ACLs are used to protect sensitive endpoints such as /admin, this flaw could have allowed unauthorized access. The confidentiality impact depends on what data is exposed: if sensitive administrative data is exposed, the impact may be high, otherwise it may be moderate. This issue is fixed in version 4.9.6.

• CWE-706

• https://github.com/honojs/hono/commit/1d79aedc3f82d8c9969b115fe61bc4bd705ec8dePatch
• https://github.com/honojs/hono/releases/tag/v4.9.6Release Notes
• https://github.com/honojs/hono/security/advisories/GHSA-9hp6-4448-45g2Vendor Advisory

Published

Sep 5, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-583575ire is a cross-platform desktop artificial intelligence ass…9.6
• CVE-2025-58358Markdownify is a Model Context Protocol server for convertin…7.5
• CVE-2025-58359ZF FROST is a Rust implementation of FROST (Flexible Round-O…6
• CVE-2025-5836A vulnerability was found in Tenda AC9 15.03.02.13. It has b…6.3
• CVE-2025-58360GeoServer is an open source server that allows users to shar…9.8
• CVE-2025-58361Promptcraft Forge Studio is a toolkit for evaluating, optimi…9.3
• CVE-2025-58364OpenPrinting CUPS is an open source printing system for Linu…6.5
• CVE-2025-58365The XWiki blog application allows users of the XWiki platfor…8.7
• CVE-2025-58366Onyxia is a data science environment for kubernetes. In vers…9.4
• CVE-2025-58367DeepDiff is a project focused on Deep Difference and search …10
• CVE-2025-58369fs2 is a compositional, streaming I/O library for Scala. Ver…5.3
• CVE-2025-5837A vulnerability classified as critical has been found in PHP…8.8