CVE-2026-84365: Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

September 8, 2026

The fix released for CVE-2026-39408 does not cover every traversal sequence. toSSG() can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments.

References

github.com/advisories/GHSA-gqvv-2mrq-wpjv
github.com/honojs/hono/commit/3a67f7f3997e1437d108f7bcba2dbcee2df69221
github.com/honojs/hono/releases/tag/v4.13.5
github.com/honojs/hono/security/advisories/GHSA-gqvv-2mrq-wpjv
nvd.nist.gov/vuln/detail/CVE-2026-84365

Code Behaviors & Features

Detect and mitigate CVE-2026-84365 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →