CVE-2026-84365: Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

September 8, 2026

The fix released for CVE-2026-39408 does not cover every traversal sequence. toSSG() can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments.

References

github.com/advisories/GHSA-gqvv-2mrq-wpjv
github.com/honojs/hono/commit/3a67f7f3997e1437d108f7bcba2dbcee2df69221
github.com/honojs/hono/releases/tag/v4.13.5
github.com/honojs/hono/security/advisories/GHSA-gqvv-2mrq-wpjv
nvd.nist.gov/vuln/detail/CVE-2026-84365

Code Behaviors & Features

Detect and mitigate CVE-2026-84365 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →