CVE-2025-58362 json
Hono contains a flaw in URL path parsing, potentially leading to path confusion
published 2025-09-03 14 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-26876 , GHSA-9hp6-4448-45g2
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility function which could allow path confusion and potential bypass of proxy-level ACLs (e.g. Nginx location blocks). The original implementation relied on fixed character offsets when parsing request URLs. Under certain malformed absolute-form Request-URIs, this could lead to incorrect path extraction depending on the application and environment. If proxy ACLs are used to protect sensitive endpoints such as /admin, this flaw could have allowed unauthorized access. The confidentiality impact depends on what data is exposed: if sensitive administrative data is exposed, the impact may be high, otherwise it may be moderate. This issue is fixed in version 4.9.6.
Patch / fix
- npm hono 4.9.6
- hono hono 4.9.6
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 14 mo ago
Exploit prediction
0.58% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | hono | >=4.8.0, <4.9.6 |
4.9.6 |
Affected products
- honojs hono
Classification
- Weakness
-
- CWE-706 Use of Incorrectly-Resolved Name or Reference
References
-
github.com
/honojs/hono/commit/1d79aedc3f82d8c9969b115fe61bc4bd705ec8de
web, patch
-
github.com
/honojs/hono/security/advisories/GHSA-9hp6-4448-45g2
web, vendor-advisory
-
github.com
/honojs/hono/releases/tag/v4.9.6
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2025-58362
advisory
-
github.com
/honojs/hono
package
Sources
- CVE List CVE-2025-58362
- GitHub Advisory GHSA-9hp6-4448-45g2
- NVD CVE-2025-58362
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.