CVE-2026-24473 MEDIUM

CVE-2026-24473: Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)

Vendor Honojs
Product hono
Weakness CWE-200 · Info exposure
Published January 27, 2026
Last update January 27, 2026
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Serve static Middleware for the Cloudflare Workers adapter contains an information disclosure vulnerability that may allow attackers to read arbitrary keys from the Workers environment. Improper validation of user-controlled paths can result in unintended access to internal asset keys. Version 4.11.7 contains a patch for the issue.

Key dates

02Disclosure timeline

January 27, 2026 CVE published
January 27, 2026 Record updated