H
ono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Middleware contains an information disclosure vulnerability caused by improper handling of HTTP cache control directives. The middleware does not respect standard cache control headers such as `Cache-Control: private` or `Cache-Control: no-store`, which may result in private or authenticated responses being cached and subsequently exposed to unauthorized users. Version 4.11.7 has a patch for the issue.
References
| Link | Resource |
|---|---|
| https://github.com/honojs/hono/commit/12c511745b3f1e7a3f863a23ce5f921c7fa805d1 | Patch |
| https://github.com/honojs/hono/releases/tag/v4.11.7 | Release Notes |
| https://github.com/honojs/hono/security/advisories/GHSA-6wqw-2p9w-4vw4 | Vendor Advisory |
Configurations
History
04 Feb 2026, 15:32
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Hono hono
Hono |
|
| CPE | cpe:2.3:a:hono:hono:*:*:*:*:*:node.js:*:* | |
| References | () https://github.com/honojs/hono/commit/12c511745b3f1e7a3f863a23ce5f921c7fa805d1 - Patch | |
| References | () https://github.com/honojs/hono/releases/tag/v4.11.7 - Release Notes | |
| References | () https://github.com/honojs/hono/security/advisories/GHSA-6wqw-2p9w-4vw4 - Vendor Advisory |
27 Jan 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-27 20:16
Updated : 2026-02-04 15:32
NVD link : CVE-2026-24472
Mitre link : CVE-2026-24472
CVE.ORG link : CVE-2026-24472
JSON object : View