CVE-2026-84365

Executive Summary

CVE-2026-84365 is a path traversal vulnerability in the Hono web application framework affecting its static site generation (SSG) functionality in versions 4.12.12 through 4.13.4. The flaw permits an attacker who can influence ssgParams values to write files outside the intended output directory during build-time SSG, potentially overwriting arbitrary files in the build environment. This vulnerability is a follow-up to CVE-2026-39408, whose fix was determined to be incomplete because it fails to handle all traversal sequences — specifically consecutive parent-directory segments. The issue is limited to build-time static site generation; request-time routing and applications with fully developer-controlled ssgParams are not affected. The vulnerability carries a CVSS score of 6.5 and has no known public exploit or patch beyond the version 4.13.5 release.

Technical Analysis

Hono's static site generation (SSG) feature constructs output file paths by combining the route path with values supplied via the ssgParams mechanism. Each output path is then validated against the configured output directory using a normalization routine. The intended guarantee is that generated files remain within the designated output directory.

The vulnerability arises from two distinct deficiencies in this normalization and validation process:

1. Incomplete Traversal Collapse: The normalization routine does not fully collapse runs of consecutive parent-directory segments (e.g., ../../.. sequences). When a route parameter contains multiple consecutive parent-directory segments, the normalization produces a path that passes the validation check but, when resolved by the filesystem, points outside the intended output directory.

2. Inconsistent Rooting Equivalence: The validation logic treats output directories that differ in their rooting style as equivalent. This means a path that appears to be confined within the output directory under one rooting interpretation can resolve to an entirely different location outside that directory under another interpretation.

The attack surface is the build-time SSG pipeline. An application is vulnerable when it generates a static site from route parameter values it does not fully control — for example, slugs originating from a CMS, an external API, or direct user submissions. When such an untrusted value is passed through ssgParams, it becomes part of the output file path construction. The attacker-controlled value can contain traversal sequences that, due to the incomplete normalization, bypass the validation check and direct the file write operation to an arbitrary location.

It is important to note that the technical details available from the NVD description are insufficient to identify specific code-level function names, class names, or exact routine implementations beyond the generic concepts described. The vulnerability class is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), and the attack mechanism is traversal sequence injection during file path construction.

The scope is explicitly limited to build-time operational contexts. Because SSG is a build process, the exploitation vector would typically involve an attacker submitting crafted content (e.g., a CMS slug) that subsequently flows into the SSG path construction pipeline during the build.

Exploitation Scenarios

Step 1 — Reconnaissance/Target Identification: The attacker identifies a Hono-based application (version 4.12.12–4.13.4) that uses SSG to generate static output. Key indicators include applications that generate static pages from CMS-managed content, blog platforms with user-submitted slug fields, or any deployment that pulls content from an API into a static build pipeline. The attacker would look for ways to inject or modify the content values that feed into ssgParams, such as a CMS with weak input validation or an open content submission endpoint.

Step 2 — Triggering the Vulnerability: The attacker crafts a malicious slug or content value containing consecutive parent-directory traversal segments (e.g., values containing sequences like /../../../../). This value is submitted through the legitimate content pipeline — for example, by creating a CMS entry with a crafted slug field. When the build process runs, Hono's SSG routine incorporates this value into the output path construction. The normalization validation accepts the path due to the incomplete traversal collapse, and the file write proceeds.

Step 3 — Payload/Execution at Vulnerability-Class Level: At the vulnerability-class level (CWE-22 path traversal), the payload is a path traversal sequence embedded in the route parameter. The attacker crafts the parameter to resolve to a target file location outside the configured output directory. Because the write occurs during the build process, the attacker can choose a destination path that causes either file creation (new file planted in a sensitive location) or file overwrite (modifying an existing generated artifact or deployment file). The exact destination is constrained by the attacker's ability to set the traversal depth and the filesystem structure of the build environment. No public PoC is available; the attack chain is inferred from the vulnerability class.

Step 4 — Post-Exploitation Impact: Successful exploitation results in unauthorized file writes within the build environment. The attacker can alter generated artifacts — for example, replacing a generated HTML page with malicious content, modifying configuration files that are part of the deployment output, or potentially overwriting files that affect the build pipeline itself. In a CI/CD context, this can lead to modified deployment artifacts being published to production, potentially enabling content injection, defacement, or supply-chain-style tampering of the final static output. The confidentiality impact is none (C: N), while the integrity impact is high (I: H) — the attacker can corrupt or replace legitimate generated content.

Impact Assessment

CVSS Analysis: The vulnerability scores 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. The network attack vector reflects that the attacker can submit hostile content over the network. Low attack complexity and no privileges required indicate the barrier to triggering the flaw is minimal — any unauthenticated user who can influence content that flows into ssgParams is sufficient. User interaction (R) is required, reflecting that the attacker's malicious input must be processed by a build pipeline initiated by a human operator or automated build trigger. The availability impact is none; the principal damage is integrity loss (high impact), driven by the ability to overwrite files in the build environment.

Business Impact:

• Supply Chain Risk: In CI/CD pipelines, tampering with generated static artifacts can result in malicious content being deployed to production websites.
• Integrity Compromise: Altered build outputs can undermine trust in the generated site or application deployment.
• Build Environment Compromise: Overwritten files outside the output directory could include build configuration, secrets, or scripts, leading to further lateral movement within the build system.

Affected Systems:

• Hono framework versions 4.12.12 through 4.13.4
• Any application using Hono SSG with ssgParams values derived from untrusted or partially controlled data sources (CMS, APIs, user submissions)
• Build-time operations only; request-time Hono routing is not affected

Blast Radius: The blast radius is concentrated in development and deployment infrastructure rather than end users. However, the downstream effect of corrupted deployment artifacts can extend to all visitors of a compromised static site. The lack of confidentiality impact limits information disclosure risk, but the integrity damage can have lasting trust implications.

Detection Guidance

Note: The following detection signatures target path traversal patterns in HTTP content that flows into SSG parameters and related file-write anomalies. Because this is a build-time vulnerability, network-only detection may miss the attack vector if content ingestion and build execution occur through non-network channels. Detection should combine network inspection with filesystem and build-log monitoring.

Sigma Rule

title: Hono SSG Path Traversal via Consecutive Parent Directory Segments
id: 8f7c3d2e-4b1a-4c9f-8d2e-6a3b5c7d9e1f
status: experimental
description: Detects HTTP requests containing consecutive parent-directory traversal sequences in parameters that may feed into Hono SSG path construction (CVE-2026-84365)
logsource:
  category: webserver
  product: generic
detection:
  selection_traversal:
    c-uri|contains:
      - '/../../'
      - '%2e%2e%2f%2e%2e%2f'
    cs-method:
      - POST
      - PUT
      - GET
  selection_slug_param:
    cs-uri-query|contains:
      - 'slug='
      - 'ssg'
      - 'static'
  condition: selection_traversal and selection_slug_param
falsepositives:
  - Legitimate web application debugging tools sending path traversal-like test sequences
  - Applications that legitimately process relative paths in query strings
level: medium
tags:
  - attack.t1190
  - attack.t1083
  - cve.2026.84365
  - cwe.22

YARA Rule

rule Hono_SSG_PathTraversal_ConsecutiveParents_CVE_2026_84365 {
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects path traversal sequences with consecutive parent-directory segments targeting Hono SSG parameters (CVE-2026-84365)"
        cve = "2026-84365"
        cwe = "22"
        date = "2026-04-01"
        severity = "medium"
    strings:
        $traversal_dotdot = "../../" 
        $traversal_dotdot_url = "%2e%2e%2f%2e%2e%2f"
        $traversal_params = "ssgParams" nocase
        $traversal_slug = "slug=" nocase
        $traversal_route_param = "params=" nocase
    condition:
        uint16(0) == 0x0D0A or uint16(0) == 0x0A0D or filesize < 10MB and
        (any of ($traversal_dotdot*) or any of ($traversal_dotdot_url*)) and
        (any of ($traversal_params*) or any of ($traversal_slug*) or any of ($traversal_route_param*))
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"ET WEB_SERVER Hono SSG Path Traversal Attempt - CVE-2026-84365";
    flow:established,to_server;
    content:"/../../";
    http_uri;
    pcre:"/(?:\.\.\/){2,}/i";
    classtype:attempted-user;
    sid:30000120;
    rev:1;
    metadata:created_at 2026_04_01, updated_at 2026_04_01, cve 2026_84365, severity HIGH;
)

Elastic Detection

// Detect HTTP requests with traversal sequences in URI parameters (post-Hono ingestion)
sequence by source.ip with maxspan=30s
  [network where network.protocol == "http" and 
     event.action in ("connection_attempt", "auth") and
     url.original like "*%2e%2e%2f%2e%2e%2f*" or
     url.original like "*/../..*"
  ]
  [file where event.action in ("create", "modify") and
     process.name like "*node*" and
     not file.path like "*/output/*" and
     file.extension in ("html", "htm", "js", "json", "css", "xml", "config", "txt", "php", "py", "sh")
  ]

Note: Adjust the file filter to match actual SSG output extensions and directory conventions.

Splunk SPL Query

index=weblog OR index=proxy sourcetype=access_combined
| where match(uri, "(?i)(%2e%2e%2f|%2e%2e%5c|\.\./){2,}") 
| stats count by src_ip, uri, method, status
| fields src_ip, uri, method, status, count
| sort -count
| table _time, src_ip, uri, method, status, count
| rename "src_ip" as "Attacker IP", "uri" as "Request URI", "method" as "HTTP Method", "status" as "HTTP Status"

// Build-environment file-anomaly query (run against host logs)
index=build_system sourcetype=builder
| regex _raw = "(?i)(create|write|open|rename).*\.\.\/\.\.\/"
| eventstats count as attempts by host
| table _time, host, user, _raw
| where attempts > 3

Wazuh OSSEC Rule

<group name="hono_ssg_traversal,">
  <rule id="100843" level="10">
    <decoded_as>json</decoded_as>
    <match>(?i)(\.\./){2,}|%2e%2e%2f%2e%2e%2f</match>
    <description>CVE-2026-84365 - Probable path traversal attempt against Hono SSG build</description>
    <group>web_application,attack,t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100844" level="8">
    <match>writing to path outside output directory|OUTSIDE_OUTPUT</match>
    <description>CVE-2026-84365 - Hono SSG file write outside configured output directory detected</description>
    <group>hono,ssg,build_integrity,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from tracked sources has been confirmed, though the NVD description indicates the issue is fixed in Hono version 4.13.5.

1. Immediate Mitigations (deploy now):

• Upgrade Hono to version 4.13.5 or later. The NVD description explicitly states this version resolves the incomplete fix from CVE-2026-39408. While patch evidence is not yet tracked in external sources at time of writing, the vendor-referenced fix is the primary remediation.
• Sanitize ssgParams inputs: If upgrading is not immediately feasible, implement explicit input validation on all ssgParams values that derive from sources outside full developer control. Reject any value containing .., /, \, or percent-encoded equivalents.
• Environment isolation: Run SSG build processes in isolated containers or sandboxes with restricted filesystem write permissions. Limit the build user's access to only the required output and dependency directories.
• Output validation after build: Add a post-build verification step that programmatically checks that all generated files reside within the intended output directory tree.

2. Patch/Upgrade Steps:

• Identify all Hono installations in your ecosystem: run npm list hono or equivalent package-manager queries in all JS/TS projects.
• Verify the affected version range: 4.12.12 ≤ version ≤ 4.13.4.
• Update to 4.13.5: npm install hono@4.13.5 (or equivalent for your package manager).
• Run regression tests on the SSG build pipeline after upgrade.
• Confirm no other Hono-dependent packages have pinned incompatible version ranges.

3. Long-Term Hardening:

• Review all SSG pipelines: Audit each usage of ssgParams to ensure every value source is fully trusted and controlled by the development team. Add comments flagging any data flow that violates this rule.
• Apply the principle of least privilege to all build processes — filesystem write permissions should be scoped to output directories plus minimal dependencies.
• Implement content validation at ingestion points: For CMS-based content, enforce validation of slugs and identifiers at the point of submission, not only during the build.
• Monitor upstream advisories: Track Hono release notes for any additional fixes related to traversal handling, as the repeated failure pattern (CVE-2026-39408 followed by this CVE) suggests ongoing normalization weaknesses.
• Update CI/CD pipeline monitoring to include file-write telemetry from build stages, allowing detection of write operations outside expected directories.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-84365 — Official NVD vulnerability record with CVSS vector, CWE-22 classification, and full description.
2. Hono Official Website: https://hono.dev/ — Framework documentation; version 4.13.5 release notes contain the fix for this issue.
3. Hono GitHub Repository: https://github.com/honojs/hono — Source repository; commit history for version 4.13.5 provides the code-level fix details.
4. Prior Advisory — CVE-2026-39408: Reference this prior vulnerability in Hono SSG to understand the incomplete first fix and the evolution of this attack vector.
5. MITRE ATT&CK: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application technique; relevant for tracking build-time exploitation chains.

Threat Actor Activity / Exploit-in-the-Wild Evidence: No known threat actor campaigns or in-the-wild exploitation evidence exists at the time of this report. The vulnerability has no public PoC, no exploit code, and no CISA KEV listing. The CVSS user-interaction requirement and build-time-only scope limit likely attacker interest, though the integrity impact makes it a viable target in supply-chain attack contexts.