CVE-2026-39408
Last modified
CVE-2026-39408 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be written outside the configured output directory during static site generation. EPSS estimates a 0.53% chance of exploitation in the next 30 days.
Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via ssgParams, specially crafted values can cause generated file paths to escape the intended output directory. This vulnerability is fixed in 4.12.12.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hono | Hono | >= 4.0.0, <= 4.12.11 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-39408?
How severe is CVE-2026-39408?
How do I fix CVE-2026-39408?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-39400Cronicle is a multi-server task scheduler and runner, with a…6.1
- CVE-2026-39401Cronicle is a multi-server task scheduler and runner, with a…5.4
- CVE-2026-39402lxc is a Linux container runtime. In the setuid helper lxc-u…6.5
- CVE-2026-39405Frappe Learning Management System (LMS) is a learning system…9.4
- CVE-2026-39406@hono/node-server allows running the Hono application on Nod…5.3
- CVE-2026-39407Hono is a Web application framework that provides support fo…5.3
- CVE-2026-39409Hono is a Web application framework that provides support fo…5.3
- CVE-2026-3941Insufficient policy enforcement in DevTools in Google Chrome…4.3
- CVE-2026-39410Hono is a Web application framework that provides support fo…4.8
- CVE-2026-39411LobeHub is a work-and-lifestyle space to find, build, and co…7.1
- CVE-2026-39412LiquidJS is a Shopify / GitHub Pages compatible template eng…7.5
- CVE-2026-39413LightRAG provides simple and fast retrieval-augmented genera…6.5
Are you affected by CVE-2026-39408?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST