Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-24473 · CVE overview and exploitation status

EUVD-2026-4751

GHSA-w332-q679-j88p

cve-program · CVE-2026-24473

• https://github.com/honojs/hono/security/advisories/GHSA-w332-q679-j88p
• https://github.com/honojs/hono/commit/cf9a78db4d0a19b117aee399cbe9d3a6d9bfd817
• https://github.com/honojs/hono/releases/tag/v4.11.7

euvd · EUVD-2026-4751

• https://github.com/honojs/hono/security/advisories/GHSA-w332-q679-j88p
• https://github.com/honojs/hono/commit/cf9a78db4d0a19b117aee399cbe9d3a6d9bfd817
• https://github.com/honojs/hono/releases/tag/v4.11.7

nvd · CVE-2026-24473

• https://github.com/honojs/hono/commit/cf9a78db4d0a19b117aee399cbe9d3a6d9bfd817
• https://github.com/honojs/hono/releases/tag/v4.11.7
• https://github.com/honojs/hono/security/advisories/GHSA-w332-q679-j88p

osv · GHSA-w332-q679-j88p

• https://github.com/honojs/hono/security/advisories/GHSA-w332-q679-j88p
• https://nvd.nist.gov/vuln/detail/CVE-2026-24473
• https://github.com/honojs/hono/commit/cf9a78db4d0a19b117aee399cbe9d3a6d9bfd817
• https://github.com/honojs/hono
• https://github.com/honojs/hono/releases/tag/v4.11.7

• Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Serve static Middleware for the Cloudflare Workers adapter contains an information disclosure vulnerability that may allow attack… · Advisory content revised · 15 Nov 2026