CVE-2026-24472: Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception
(updated )
Cache Middleware contains an information disclosure vulnerability caused by improper handling of HTTP cache control directives. The middleware does not respect standard cache control headers such as Cache-Control: private or Cache-Control: no-store, which may result in private or authenticated responses being cached and subsequently exposed to unauthorized users.
References
Code Behaviors & Features
Detect and mitigate CVE-2026-24472 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →