CVE-2024-32869 Hono vulnerable to Restricted Directory Traversal in serveStatic with deno
Attackers can traverse directories to read unexpected files when using serveStatic with Deno in the Hono web framework.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-32869?
CVE-2024-32869 is a medium-severity path traversal vulnerability in honojs hono, published on 23 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.2.7, when using serveStatic with deno, it is possible to traverse the directory where `main.ts` is located. This can result in retrieval of unexpected files. Version 4.2.7 contains a patch for the issue.
Weakness: CWE-22
Which versions are affected by CVE-2024-32869?
2 open source packages ship an affected version, including hono. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
hono npm | All versions | 4.2.7 |
hono npm | All versions | 4.2.7 |
Products include Hono Hono.
How do I fix CVE-2024-32869?
Upgrade hono to 4.2.7 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-32869 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-32869 exists.
Other vulnerabilities in honojs hono
- CVE-2026-27700 Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
- CVE-2026-22817 JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass
- CVE-2026-22818 JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)
- CVE-2025-62610 Hono Improperly Authorizes JWT Audience Validation
- CVE-2026-29045 Hono: Arbitrary file access via serveStatic vulnerability
Sources
Also known as GHSA-3mpf-rcc7-5347.