{"id":"GHSA-9hp6-4448-45g2","summary":"Hono's flaw in URL path parsing could cause path confusion","details":"### Summary\n\nA flaw in the `getPath` utility function could allow path confusion and potential bypass of proxy-level ACLs (e.g. Nginx location blocks).\n\n### Details\n\nThe original implementation relied on fixed character offsets when parsing request URLs. Under certain malformed absolute-form Request-URIs, this could lead to incorrect path extraction.\n\nMost standards-compliant runtimes and reverse proxies reject such malformed requests with a 400 Bad Request, so the impact depends on the application and environment.\n\n### Impact\n\nIf proxy ACLs are used to protect sensitive endpoints such as `/admin`, this flaw could have allowed unauthorized access. The confidentiality impact depends on what data is exposed: if sensitive administrative data is exposed, the impact may be High (CVSS 7.5); otherwise it may be Medium (CVSS 5.3).\n\n### Resolution\n\nThe implementation has been updated to correctly locate the first slash after \"://\", preventing such path confusion.","aliases":["CVE-2025-58362"],"modified":"2025-09-05T16:11:28Z","published":"2025-09-03T21:30:13Z","database_specific":{"github_reviewed_at":"2025-09-03T21:30:13Z","nvd_published_at":"2025-09-05T00:15:32Z","cwe_ids":["CWE-706"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/honojs/hono/security/advisories/GHSA-9hp6-4448-45g2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58362"},{"type":"WEB","url":"https://github.com/honojs/hono/commit/1d79aedc3f82d8c9969b115fe61bc4bd705ec8de"},{"type":"PACKAGE","url":"https://github.com/honojs/hono"},{"type":"WEB","url":"https://github.com/honojs/hono/releases/tag/v4.9.6"}],"affected":[{"package":{"name":"hono","ecosystem":"npm","purl":"pkg:npm/hono"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.8.0"},{"fixed":"4.9.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-9hp6-4448-45g2/GHSA-9hp6-4448-45g2.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}