CVE-2025-58362: Hono's flaw in URL path parsing could cause path confusion

September 3, 2025 (updated September 5, 2025)

A flaw in the getPath utility function could allow path confusion and potential bypass of proxy-level ACLs (e.g. Nginx location blocks).

References

github.com/advisories/GHSA-9hp6-4448-45g2
github.com/honojs/hono
github.com/honojs/hono/commit/1d79aedc3f82d8c9969b115fe61bc4bd705ec8de
github.com/honojs/hono/releases/tag/v4.9.6
github.com/honojs/hono/security/advisories/GHSA-9hp6-4448-45g2
nvd.nist.gov/vuln/detail/CVE-2025-58362

Code Behaviors & Features

Detect and mitigate CVE-2025-58362 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →