CVE-2026-39408: Hono has a path traversal in toSSG() allows writing files outside the output directory

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-08 · updated 2026-07-24
Weakness: CWE-22

Description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via ssgParams, specially crafted values can cause generated file paths to escape the intended output directory. This vulnerability is fixed in 4.12.12.

Affected products

honojs hono: from 4.0.0 through 4.12.11

References

https://github.com/honojs/hono/commit/b470278920fffcfd6d76002755d6db53db827679
https://github.com/honojs/hono/releases/tag/v4.12.12
https://github.com/honojs/hono/security/advisories/GHSA-xf4j-xp2r-rqqx

Get alerted when CVE-2026-39408 or the next vulnerability affects your stack