CVE-2025-58362 json
Hono contains a flaw in URL path parsing, potentially leading to path confusion
published last yr. modified 4mo ago also EUVD-2025-26876 , GHSA-9hp6-4448-45g2
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility function which could allow path confusion and potential bypass of proxy-level ACLs (e.g. Nginx location blocks). The original implementation relied on fixed character offsets when parsing request URLs. Under certain malformed absolute-form Request-URIs, this could lead to incorrect path extraction depending on the application and environment. If proxy ACLs are used to protect sensitive endpoints such as /admin, this flaw could have allowed unauthorized access. The confidentiality impact depends on what data is exposed: if sensitive administrative data is exposed, the impact may be high, otherwise it may be moderate. This issue is fixed in version 4.9.6.
Patch / fix
- npm hono 4.9.6
- hono hono 4.9.6
Is CVE-2025-58362 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.58% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | hono | >=4.8.0, <4.9.6 |
4.9.6 |
Affected products
- honojs hono
Classification
- Weakness
-
- CWE-706 Use of Incorrectly-Resolved Name or Reference
References
-
github.com
/honojs/hono/commit/1d79aedc3f82d8c9969b115fe61bc4bd705ec8de
web, patch
-
github.com
/honojs/hono/security/advisories/GHSA-9hp6-4448-45g2
web, vendor-advisory
-
github.com
/honojs/hono/releases/tag/v4.9.6
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2025-58362
advisory
-
github.com
/honojs/hono
package
Sources
- CVE List CVE-2025-58362
- GitHub Advisory GHSA-9hp6-4448-45g2
- NVD CVE-2025-58362
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.