{"id":"CVE-2025-58362","aliases":["GHSA-9hp6-4448-45g2"],"url":"https://o3.security/vulnerability/CVE-2025-58362","summary":"Hono contains a flaw in URL path parsing, potentially leading to path confusion","details":"### Summary\n\nA flaw in the `getPath` utility function could allow path confusion and potential bypass of proxy-level ACLs (e.g. Nginx location blocks).\n\n### Details\n\nThe original implementation relied on fixed character offsets when parsing request URLs. Under certain malformed absolute-form Request-URIs, this could lead to incorrect path extraction.\n\nMost standards-compliant runtimes and reverse proxies reject such malformed requests with a 400 Bad Request, so the impact depends on the application and environment.\n\n### Impact\n\nIf proxy ACLs are used to protect sensitive endpoints such as `/admin`, this flaw could have allowed unauthorized access. The confidentiality impact depends on what data is exposed: if sensitive administrative data is exposed, the impact may be High (CVSS 7.5); otherwise it may be Medium (CVSS 5.3).\n\n### Resolution\n\nThe implementation has been updated to correctly locate the first slash after \"://\", preventing such path confusion.","published":"2025-09-04T23:56:13.983Z","modified":"2026-08-12T03:51:38.801669136Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"hono","fixedVersion":"4.9.6"}],"fix":{"url":"https://github.com/honojs/hono/commit/1d79aedc3f82d8c9969b115fe61bc4bd705ec8de","label":"honojs/hono@1d79aed"},"references":[{"type":"WEB","url":"https://github.com/honojs/hono/releases/tag/v4.9.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58362.json"},{"type":"ADVISORY","url":"https://github.com/honojs/hono/security/advisories/GHSA-9hp6-4448-45g2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58362"},{"type":"FIX","url":"https://github.com/honojs/hono/commit/1d79aedc3f82d8c9969b115fe61bc4bd705ec8de"},{"type":"PACKAGE","url":"https://github.com/honojs/hono"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:38.801669136Z"}}