{"action":"Upgrade hono to 4.13.5 or later.","affected":[{"fixed":"4.13.5","introduced":"0"}],"component":"hono","cve_ids":["CVE-2026-84365"],"ecosystem":"npm","epss":0.00437,"exploited":false,"fixed_versions":["4.13.5"],"ghsa_id":"GHSA-gqvv-2mrq-wpjv","id":"tcs_01M5KFSC7MEV8W23YQRQBYWBCB","modified_at":"2026-09-08T21:30:04.760578762Z","published_at":"2026-09-08T21:23:51Z","references":["https://osv.dev/vulnerability/GHSA-gqvv-2mrq-wpjv","https://github.com/honojs/hono/security/advisories/GHSA-gqvv-2mrq-wpjv","https://nvd.nist.gov/vuln/detail/CVE-2026-84365","https://github.com/honojs/hono/commit/3a67f7f3997e1437d108f7bcba2dbcee2df69221","https://github.com/honojs/hono","https://github.com/honojs/hono/releases/tag/v4.13.5"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-gqvv-2mrq-wpjv","url":"https://osv.dev/vulnerability/GHSA-gqvv-2mrq-wpjv"}],"summary":"Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory"}