CVE-2026-84365: Hono Package Incomplete Fix Allows File Write Outside Output Directory
Summary
CVE-2026-84365: Hono: Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory. Affects hono versions < 4.13.5. Fixed in 4.13.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hono is an npm package designed for building static sites efficiently. It generates output paths based on route parameters and user-defined values, ensuring that the generated files remain within a specified output directory. However, due to a flaw in its path normalization process, it is vulnerable to directory traversal attacks, which can lead to unintended file writes outside the designated output area.
Vulnerability Detail
The vulnerability arises from an incomplete fix for a previous issue (CVE-2026-39408). The function toSSG() fails to fully collapse consecutive parent-directory segments in paths, allowing an attacker to manipulate route parameters to write files outside the intended output directory. This can lead to unauthorized file creation or overwriting in the build environment, potentially altering generated artifacts or deployment outputs. The vulnerability primarily affects static site generation during build time, while request-time routing remains unaffected.
How To Fix
Latest published version: 4.13.13 as of 23 Oct 2026
npm install hono@4.13.13Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.13.5
This is the first release that contains the fix.
npm install hono@4.13.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that all values passed to ssgParams are sanitized and controlled by developers, preventing untrusted input from reaching the static site generation process.
Conclusion
CVE-2026-84365 represents a significant risk for applications using the Hono package, particularly those that allow untrusted input in static site generation. It is crucial to update to the patched version or implement workarounds to mitigate potential risks.
See every vulnerability recorded for hono →
FAQ
CVE-2026-84365 is a vulnerability in the Hono package that allows files to be written outside the intended output directory due to an incomplete fix for a previous issue.
If your application uses untrusted input for route parameters, it may lead to unauthorized file writes, potentially compromising your build environment.
In the meantime, ensure that all inputs to ssgParams are sanitized and controlled to prevent untrusted values from being processed.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application's package-lock.json for vulnerabilities without needing to sign up.
The CVSS score for CVE-2026-84365 is 6.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for hono.
