Detections
Analytics

Echo: hono: security update to 4.13.5

medium Tenable Self-Hosted Container Security Plugin ID 458221

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until
 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG() can still
 write files outside the configured output directory when a route parameter contains consecutive parent-
 directory segments. Static site generation builds each output path from the route path and values supplied
 through ssgParams, then verifies that the result stays inside the output directory using the same
 normalization routine that built the path. That routine does not fully collapse runs of consecutive
 parent-directory segments, allowing a path that the check accepts to resolve outside the output directory,
 and the check also treats output directories that differ in how they are rooted as equivalent. This arises
 when an application generates a static site from route parameter values it does not fully control, such as
 slugs from a CMS, API, or user submission. An untrusted ssgParams value can create or overwrite files
 elsewhere in the build environment and alter generated artifacts or deployment output. The vulnerability
 affects build-time static site generation only; request-time routing and applications with entirely
 developer-controlled ssgParams values are not affected. This issue is fixed in version 4.13.5.
 (CVE-2026-84365)

Solution

Update the hono library and its related packages to version 4.13.5 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-84365

Plugin Details

Severity: Medium

ID: 458221

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/5/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.62

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2026-84365

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/28/2026

Vulnerability Publication Date: 9/1/2026

Reference Information

CVE: CVE-2026-84365