What’s Vulnerable › Vulnerabilities

CVE-2024-32869: Hono vulnerable to Restricted Directory Traversal in serveStatic with deno

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-04-23 · updated 2026-06-17
• Weakness: CWE-22

Description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.2.7, when using serveStatic with deno, it is possible to traverse the directory where `main.ts` is located. This can result in retrieval of unexpected files. Version 4.2.7 contains a patch for the issue.

Affected products

• honojs hono: before 4.2.7 — fixed in 4.2.7

How to fix

Upgrade to a fixed version: honojs hono 4.2.7. Check the vendor advisory for mitigations.

References

• https://github.com/honojs/hono/commit/92e65fbb6e5e7372650e7690dbd84938432d9e65
• https://github.com/honojs/hono/security/advisories/GHSA-3mpf-rcc7-5347
• https://github.com/honojs/hono/commit/92e65fbb6e5e7372650e7690dbd84938432d9e65
• https://github.com/honojs/hono/security/advisories/GHSA-3mpf-rcc7-5347

Get alerted when CVE-2024-32869 or the next vulnerability affects your stack