CVE-2025-58362: Hono contains a flaw in URL path parsing, potentially leading to path confusion
Summary
A flaw in the getPath utility function could allow path confusion and potential bypass of proxy-level ACLs (e.g. Nginx location blocks).
Details
The original implementation relied on fixed character offsets when parsing request URLs. Under certain malformed absolute-form Request-URIs, this could lead to incorrect path extraction.
Most standards-compliant runtimes and reverse proxies reject such malformed requests with a 400 Bad Request, so the impact depends on the application and environment.
Impact
If proxy ACLs are used to protect sensitive endpoints such as /admin, this flaw could have allowed unauthorized access. The confidentiality impact depends on what data is exposed: if sensitive administrative data is exposed, the impact may be High (CVSS 7.5); otherwise it may be Medium (CVSS 5.3).
Resolution
The implementation has been updated to correctly locate the first slash after "://", preventing such path confusion.
Other sources
Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility function which could allow path confusion and potential bypass of proxy-level ACLs (e.g. Nginx location blocks). The original implementation relied on fixed character offsets when parsing request URLs. Under certain malformed absolute-form Request-URIs, this could lead to incorrect path extraction depending on the application and environment. If proxy ACLs are used to protect sensitive endpoints such as /admin, this flaw could have allowed unauthorized access. The confidentiality impact depends on what data is exposed: if sensitive administrative data is exposed, the impact may be high, otherwise it may be moderate. This issue is fixed in version 4.9.6.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58362?
CVE-2025-58362 has been classified as a high severity vulnerability due to its potential to bypass proxy-level ACLs.
How do I fix CVE-2025-58362?
You can fix CVE-2025-58362 by upgrading the Hono package to version 4.9.6 or later.
What type of attack is possible with CVE-2025-58362?
CVE-2025-58362 allows for path confusion attacks that can potentially access restricted resources.
Which versions of Hono are affected by CVE-2025-58362?
CVE-2025-58362 affects Hono versions from 4.8.0 to 4.9.6, before the fix was applied.
Is CVE-2025-58362 related to Nginx configurations?
Yes, CVE-2025-58362 can bypass Nginx location blocks due to the flaw in the `getPath` utility function.