CVE-2026-84365: Hono Framework Path Traversal Vulnerability

CVE-2026-84365 Overview

Hono is a web application framework supporting multiple JavaScript runtimes. CVE-2026-84365 is a path traversal vulnerability [CWE-22] in the toSSG() static site generation helper, affecting versions 4.12.12 through 4.13.4. The flaw is an incomplete fix for CVE-2026-39408. Consecutive parent-directory segments in a route parameter bypass the output-directory containment check, allowing an attacker who controls ssgParams values to write files outside the configured output directory. The issue only affects build-time static site generation. Version 4.13.5 contains the fix.

Critical Impact
An attacker who supplies untrusted route parameter values, such as slugs from a CMS or user submissions, can create or overwrite arbitrary files in the build environment and tamper with generated deployment artifacts.

Affected Products

Hono framework versions 4.12.12 through 4.13.4
Applications using toSSG() with untrusted ssgParams values
Static site generation pipelines consuming slugs from CMSs, APIs, or user input

Discovery Timeline

2026-09-01 - CVE-2026-84365 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-84365

Vulnerability Analysis

The toSSG() helper builds each output file path by combining the route path with values supplied through ssgParams. It then verifies that the resulting path remains inside the configured output directory using the same normalization routine that constructed the path. The normalization routine does not fully collapse runs of consecutive parent-directory (..) segments. A crafted parameter can therefore produce a path that passes the containment check but resolves outside the output directory after filesystem operations.

The check also treats output directories that differ only in how they are rooted as equivalent, further widening the bypass. Build-time file writes carried out by static site generation can then create or overwrite files at arbitrary locations reachable by the build process.

Root Cause

The root cause is incomplete traversal-sequence handling in Hono's SSG path normalization helper. The original handleParent function collapsed a single .. segment but did not correctly handle multiple consecutive parent-directory segments where the previous stack entry was itself ... The prior fix for CVE-2026-39408 addressed a subset of traversal patterns but did not cover this case or UNC-style path rooting differences.

Attack Vector

Exploitation requires an application that feeds attacker-influenced values into ssgParams, such as content slugs sourced from a headless CMS, a public API, or direct user submissions. The attacker submits a slug containing consecutive .. sequences. When the build runs toSSG(), the generated file is written outside the intended output directory. Request-time routing is not affected, and applications with fully developer-controlled ssgParams values are unaffected.

typescript

// Patch in src/helper/ssg/utils.ts - corrected handleParent logic
   return path.replace(/(\\)/g, '/').replace(/\/$/g, '')
 }

-const handleParent = (resultPaths: string[], beforeParentFlag: boolean): void => {
-  if (resultPaths.length === 0 || beforeParentFlag) {
+const getUncRoot = (path: string): string | undefined => {
+  const uncRoot = path.replace(/\\/g, '/').match(/^\/\/([^/]+)\/([^/]+)/)
+  if (uncRoot) {
+    return `${uncRoot[1].toLowerCase()}/${uncRoot[2].toLowerCase()}`
+  }
+}
+
+const handleParent = (resultPaths: string[]): void => {
+  if (resultPaths.length === 0 || resultPaths[resultPaths.length - 1] === '..') {
     resultPaths.push('..')
   } else {
     resultPaths.pop()

Source: GitHub Commit 3a67f7f. The fix now preserves stacked .. entries instead of collapsing them prematurely, and adds a UNC root helper to normalize equivalent roots.

Detection Methods for CVE-2026-84365

Indicators of Compromise

Files written outside the expected static site output directory after a Hono build run
Unexpected modifications to build scripts, CI configuration, or deployment artifacts following SSG builds
CMS or API content records containing slug fields with consecutive .. sequences or UNC-style prefixes
Build logs showing directory creation paths outside the configured outDir

Detection Strategies

Inventory all Hono projects and identify calls to toSSG() where ssgParams values originate from external sources such as CMS APIs, databases, or user submissions
Scan source repositories and lockfiles for hono versions between 4.12.12 and 4.13.4
Add build-time assertions that verify every emitted file path resolves inside the configured output directory
Review CMS or content database entries for slug fields containing .., backslashes, or UNC-style prefixes

Monitoring Recommendations

Instrument CI/CD pipelines to log the absolute path of every file written by static site generation steps
Alert on write operations from build agents targeting paths outside the designated build workspace
Track dependency updates and enforce a minimum Hono version of 4.13.5 through supply chain policy tooling
Correlate CMS content changes with subsequent build output anomalies

How to Mitigate CVE-2026-84365

Immediate Actions Required

Upgrade Hono to version 4.13.5 or later in all projects that use toSSG()
Audit every source that supplies ssgParams values and treat CMS, API, and user-submitted slugs as untrusted input
Validate route parameter values against a strict allowlist such as ^[a-z0-9-]+$ before passing them to toSSG()
Run builds in isolated, ephemeral environments with least-privilege filesystem access

Patch Information

The fix is available in Hono 4.13.5. See the GitHub Release v4.13.5 and the GitHub Security Advisory GHSA-gqvv-2mrq-wpjv. The patch rewrites handleParent to preserve stacked .. entries and adds UNC root normalization so equivalent roots are no longer treated as distinct.

Workarounds

Restrict ssgParams to values generated entirely by trusted, developer-controlled code until the upgrade is deployed
Reject any parameter value containing .., /, \, or : before it reaches toSSG()
Run static site generation inside a sandbox or container that mounts only the intended output directory as writable

bash

# Upgrade Hono to the patched version
npm install hono@^4.13.5

# Verify the installed version
npm ls hono