CVE-2025-58362: Hono contains a flaw in URL path parsing, potentially leading to path confusion

Published Sep 3, 2025
·
Updated

Summary

A flaw in the getPath utility function could allow path confusion and potential bypass of proxy-level ACLs (e.g. Nginx location blocks).

Details

The original implementation relied on fixed character offsets when parsing request URLs. Under certain malformed absolute-form Request-URIs, this could lead to incorrect path extraction.

Most standards-compliant runtimes and reverse proxies reject such malformed requests with a 400 Bad Request, so the impact depends on the application and environment.

Impact

If proxy ACLs are used to protect sensitive endpoints such as /admin, this flaw could have allowed unauthorized access. The confidentiality impact depends on what data is exposed: if sensitive administrative data is exposed, the impact may be High (CVSS 7.5); otherwise it may be Medium (CVSS 5.3).

Resolution

The implementation has been updated to correctly locate the first slash after "://", preventing such path confusion.

Other sources

Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility function which could allow path confusion and potential bypass of proxy-level ACLs (e.g. Nginx location blocks). The original implementation relied on fixed character offsets when parsing request URLs. Under certain malformed absolute-form Request-URIs, this could lead to incorrect path extraction depending on the application and environment. If proxy ACLs are used to protect sensitive endpoints such as /admin, this flaw could have allowed unauthorized access. The confidentiality impact depends on what data is exposed: if sensitive administrative data is exposed, the impact may be high, otherwise it may be moderate. This issue is fixed in version 4.9.6.

MITRE

Affected Software

2 affected componentsFixes available
npm/hono>=4.8.0<4.9.6
4.9.6
Hono Hono Node.js>=4.8.0<4.9.6

Event History

Sep 3, 2025
Advisory Published
via GitHub·09:30 PM
Data Sourced
via GitHub·09:30 PM
DescriptionSeverityWeaknessAffected Software
Sep 4, 2025
CVE Published
via MITRE·11:56 PM
Data Sourced
via MITRE·11:56 PM
DescriptionSeverityWeakness
Sep 5, 2025
Data Sourced
via NVD·12:15 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:15 AM
RemedyAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2025-58362?

CVE-2025-58362 has been classified as a high severity vulnerability due to its potential to bypass proxy-level ACLs.

2

How do I fix CVE-2025-58362?

You can fix CVE-2025-58362 by upgrading the Hono package to version 4.9.6 or later.

3

What type of attack is possible with CVE-2025-58362?

CVE-2025-58362 allows for path confusion attacks that can potentially access restricted resources.

4

Which versions of Hono are affected by CVE-2025-58362?

CVE-2025-58362 affects Hono versions from 4.8.0 to 4.9.6, before the fix was applied.

5

Is CVE-2025-58362 related to Nginx configurations?

Yes, CVE-2025-58362 can bypass Nginx location blocks due to the flaw in the `getPath` utility function.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203