CVE-2026-84365: 
JavaScript vulnerability analysis and mitigation

CVE-2026-84365 is an incomplete patch vulnerability in the Hono JavaScript web framework's static site generation (SSG) helper, classified as a path traversal flaw (CWE-22). It represents a bypass of the fix previously released for CVE-2026-39408: the toSSG() function can still write files outside the configured output directory when route parameters contain consecutive parent-directory segments (e.g., a/b/../../../pwned). Affected versions span from 4.12.12 up to (but not including) 4.13.5; the vulnerability is fixed in version 4.13.5. It carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, Hono Security Advisory).

The root cause (CWE-22) lies in the path normalization routine used by toSSG() during build-time static site generation. When constructing output file paths from route parameters supplied via ssgParams, the routine normalizes the path and then checks whether the result falls within the configured output directory — but both operations use the same flawed normalization function that fails to fully collapse runs of consecutive .. segments (e.g., a/b/../../../). The prior fix for CVE-2026-39408 only handled single parent-directory segments, leaving multi-level traversal sequences unblocked. Additionally, the containment check incorrectly treated output directories with different path roots (e.g., relative vs. absolute) as equivalent, creating a mismatch between the checked path and the filesystem-resolved path. The fix in commit 3a67f7f rewrites ensureWithinOutDir() to compare path segments directly and detect root mismatches, and updates joinPaths() to correctly collapse consecutive .. segments (Hono Security Advisory, Fix Commit).

Successful exploitation allows an attacker who can influence ssgParams values — for example, by supplying malicious slugs through a CMS, API, or user submission — to cause toSSG() to create or overwrite arbitrary files outside the intended build output directory during static site generation. This can lead to tampering with generated artifacts, poisoning deployment output, or potentially achieving code execution if writable paths include configuration files, scripts, or other sensitive build artifacts. The vulnerability has no confidentiality or availability impact; the integrity impact is rated High. It is strictly a build-time issue and does not affect request-time routing or applications where ssgParams values are entirely developer-controlled (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time, per NVD SSVC assessment and Feedly threat intelligence data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (a developer must trigger a build using untrusted ssgParams values), which limits automated exploitation. The EPSS score is approximately 0.327% (26th percentile), indicating a low near-term exploitation probability (Github Advisory).

1. Identify a target application: Find a Hono application (versions 4.12.12–4.13.4) that uses toSSG() for static site generation and sources ssgParams values from an external or partially untrusted input, such as CMS slugs, API responses, or user submissions.
2. Craft a malicious route parameter: Prepare a parameter value containing consecutive parent-directory traversal sequences, e.g., a/b/../../../pwned, designed to resolve outside the configured output directory after path normalization.
3. Inject the payload into ssgParams: Supply the crafted value as a route parameter through the untrusted input channel (e.g., submit a CMS slug or API entry containing the traversal sequence).
4. Trigger the SSG build: Cause the application to execute toSSG() — typically by initiating a build pipeline or CI/CD job that generates static output.
5. Achieve arbitrary file write: The flawed normalization routine accepts the traversal path as within bounds, but the filesystem resolves it outside the output directory, writing attacker-controlled content to an arbitrary location in the build environment (Hono Security Advisory, Fix Commit).

• File System: Unexpected files created or modified outside the configured SSG output directory (e.g., ./static) during or after a build run; files with attacker-controlled content appearing in parent directories of the build output.
• Logs: Build logs showing toSSG() completing successfully for routes with parameter values containing .. sequences (e.g., a/b/../../../); absence of Path traversal detected errors in Hono versions 4.12.12–4.13.4 when such parameters are present.
• File System: Unexpected modifications to deployment artifacts, configuration files, or scripts in directories adjacent to or above the SSG output directory following a build.

Upgrade Hono to version 4.13.5 or later, which contains the complete fix for the path traversal bypass (Hono Release v4.13.5). If immediate upgrading is not possible, implement strict input validation on all ssgParams values before passing them to toSSG(): reject any values containing .. segments, path separators (/, \), or other traversal sequences. Applications where ssgParams values are entirely developer-controlled and never sourced from external input are not affected and do not require immediate action (Github Advisory).

The advisory was published by Hono maintainer yusukebe on August 26, 2026, and credited reporters pacocartones and LeonMAG for discovering the incomplete fix. The release notes for v4.13.5 explicitly call out this issue alongside two other security fixes, encouraging all users of SSG, Cache Middleware, or parseBody({ dot: true }) to upgrade promptly (Hono Release v4.13.5). No significant broader media coverage or notable community controversy has been identified beyond the official advisory.