GHSA-9hp6-4448-45g2

Source

https://github.com/advisories/GHSA-9hp6-4448-45g2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-9hp6-4448-45g2/GHSA-9hp6-4448-45g2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9hp6-4448-45g2

Aliases

CVE-2025-58362

Published

2025-09-03T21:30:13Z

Modified

2025-09-05T16:11:28Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Hono's flaw in URL path parsing could cause path confusion

Details

Summary

A flaw in the getPath utility function could allow path confusion and potential bypass of proxy-level ACLs (e.g. Nginx location blocks).

Details

The original implementation relied on fixed character offsets when parsing request URLs. Under certain malformed absolute-form Request-URIs, this could lead to incorrect path extraction.

Most standards-compliant runtimes and reverse proxies reject such malformed requests with a 400 Bad Request, so the impact depends on the application and environment.

Impact

If proxy ACLs are used to protect sensitive endpoints such as /admin, this flaw could have allowed unauthorized access. The confidentiality impact depends on what data is exposed: if sensitive administrative data is exposed, the impact may be High (CVSS 7.5); otherwise it may be Medium (CVSS 5.3).

Resolution

The implementation has been updated to correctly locate the first slash after "://", preventing such path confusion.

Database specific

{
    "nvd_published_at": "2025-09-05T00:15:32Z",
    "severity": "HIGH",
    "github_reviewed_at": "2025-09-03T21:30:13Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-706"
    ]
}

References

Affected packages

npm / hono

Package

Name: hono; View open source insights on deps.dev
Purl: pkg:npm/hono

Affected ranges

Type: SEMVER
Events: Introduced

4.8.0

Fixed

4.9.6