Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Middleware contains an information disclosure vulnerability caused by improper handling of HTTP cache control directives. The middleware does not respect standard cache control headers such as `Cache-Control: private` or `Cache-Control: no-store`, which may result in private or authenticated responses being cached and subsequently exposed to unauthorized users. Version 4.11.7 has a patch for the issue.
References
| Link | Resource |
|---|---|
| https://github.com/honojs/hono/commit/12c511745b3f1e7a3f863a23ce5f921c7fa805d1 | Patch |
| https://github.com/honojs/hono/releases/tag/v4.11.7 | Release Notes |
| https://github.com/honojs/hono/security/advisories/GHSA-6wqw-2p9w-4vw4 | Vendor Advisory |
Configurations
History
04 Feb 2026, 15:32
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/honojs/hono/commit/12c511745b3f1e7a3f863a23ce5f921c7fa805d1 - Patch | |
| References | () https://github.com/honojs/hono/releases/tag/v4.11.7 - Release Notes | |
| References | () https://github.com/honojs/hono/security/advisories/GHSA-6wqw-2p9w-4vw4 - Vendor Advisory | |
| First Time |
Hono hono
Hono |
|
| CPE | cpe:2.3:a:hono:hono:*:*:*:*:*:node.js:*:* |
27 Jan 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-27 20:16
Updated : 2026-02-04 15:32
NVD link : CVE-2026-24472
Mitre link : CVE-2026-24472
CVE.ORG link : CVE-2026-24472
JSON object : View
Products Affected
hono
- hono