CVE-2026-84365: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in honojs hono

The vulnerability arises because the path normalization routine used in static site generation does not fully collapse consecutive parent-directory segments, allowing paths that pass the check to resolve outside the configured output directory. This enables an attacker controlling ssgParams values (such as slugs from a CMS or user input) to create or overwrite files elsewhere in the build environment, potentially altering generated artifacts or deployment outputs. The flaw only impacts build-time static site generation and is addressed in hono version 4.13.5.

An attacker able to supply untrusted route parameter values during static site generation can cause files to be created or overwritten outside the intended output directory. This could lead to unauthorized modification of build artifacts or deployment outputs, impacting the integrity of the generated static site. There is no impact on request-time routing or applications that fully control ssgParams values. The vulnerability has a CVSS 3.1 score of 6.5 (medium severity) with no known exploits in the wild.

This vulnerability is fixed in hono version 4.13.5. Users should upgrade to version 4.13.5 or later to resolve the issue. Until upgrading, avoid using untrusted or user-controlled values in ssgParams during static site generation. There is no vendor advisory provided, so patch status is based on the description stating the fix is in 4.13.5.