CVE-2026-24473

Katalog CVE

CVSS 5.3 · Medium EPSS 0,47%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada hono. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Serve static Middleware for the Cloudflare Workers adapter contains an information disclosure vulnerability that may allow attackers to read arbitrary keys from the Workers environment. Improper validation of user-controlled paths can result in unintended access to internal asset keys. Version 4.11.7 contains a patch for the issue.

Rincian

Terbit di NVD

27 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-284: Improper Access Control
CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 38,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/honojs/hono/security/advisories/GHSA-w332-q679-j88p advisory vendor
• https://github.com/honojs/hono/commit/cf9a78db4d0a19b117aee399cbe9d3a6d9bfd817 patch
• https://github.com/honojs/hono/releases/tag/v4.11.7 release notes