CVE-2026-39408

OVERVIEW CVE-2026-39408 is a path traversal vulnerability in Hono, a JavaScript web application framework supporting multiple runtimes. The vulnerability exists in the toSSG() function used during static site generation, where specially crafted dynamic route parameters can cause generated files to be written outside the configured output directory, affecting versions prior to 4.12.12. SEVERITY This vulnerability carries a CVSS 3.1 score of 7.5 HIGH with a network-based attack vector that requires no authentication or user interaction. The attack has low complexity, making it relatively straightforward to exploit. The primary impact is a confidentiality breach, as attackers could read sensitive files outside the intended directory, though integrity and availability are not directly compromised. The FAUCET Risk Score of 48.0 indicates moderate overall risk. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The vulnerability does not currently appear on the Known Exploited Vulnerabilities (KEV) catalog, and it is not listed on the Hot List of actively exploited CVEs. However, given the network-accessible nature and low attack complexity, organizations running affected Hono versions should prioritize patching to version 4.12.12 or later as a precautionary measure.