CVE-2025-58362
Hono's flaw in URL path parsing could cause path confusion
Impact
### Summary A flaw in the `getPath` utility function could allow path confusion and potential bypass of proxy-level ACLs (e.g. Nginx location blocks). ### Details The original implementation relied on fixed character offsets when parsing request URLs. Under certain malformed absolute-form Request-URIs, this could lead to incorrect path extraction. Most standards-compliant runtimes and reverse proxies reject such malformed requests with a 400 Bad Request, so the impact depends on the application and environment. ### Impact If proxy ACLs are used to protect sensitive endpoints such as `/admin`, this flaw could have allowed unauthorized access. The confidentiality impact depends on what data is exposed: if sensitive administrative data is exposed, the impact may be High (CVSS 7.5); otherwise it may be Medium (CVSS 5.3). ### Resolution The implementation has been updated to correctly locate the first slash after "://", preventing such path confusion.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | hono | >= 4.8.0, < 4.9.6 | 4.9.6 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hono | Hono | from 4.8.0 before 4.9.6 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/honojs/hono/commit/1d79aedc3f82d8c9969b115fe61bc4bd705ec8de
- https://github.com/honojs/hono/releases/tag/v4.9.6
- https://github.com/honojs/hono/security/advisories/GHSA-9hp6-4448-45g2
- https://github.com/advisories/GHSA-9hp6-4448-45g2
- https://nvd.nist.gov/vuln/detail/CVE-2025-58362