CVE-2026-24473
1 advisory.
npm/hono CVE-2026-24473: medium 5.3, EPSS 0.48%
Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)
Action: Upgrade hono to 4.11.7 or later.
npm i hono@4.11.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.11.7 | - |
Fixed versions
| 4.11.7 |
Sources
- osv: GHSA-w332-q679-j88p
- https://github.com/honojs/hono/security/advisories/GHSA-w332-q679-j88p
- https://nvd.nist.gov/vuln/detail/CVE-2026-24473
- https://github.com/honojs/hono/commit/cf9a78db4d0a19b117aee399cbe9d3a6d9bfd817
- https://github.com/honojs/hono
- https://github.com/honojs/hono/releases/tag/v4.11.7
CVE-2026-24473 · published · modified · JSON