CVE-2026-84365

Name of the Vulnerable Software and Affected Versions Hono versions 4.12.12 through 4.13.4

Description The toSSG() function fails to properly collapse consecutive parent-directory segments during static site generation. This occurs when the application uses ssgParams values that are not fully controlled by the developer, such as slugs from a CMS or API. An attacker can provide a malicious ssgParams value to create or overwrite files outside the configured output directory in the build environment, potentially altering generated artifacts or deployment output. This issue specifically affects build-time static site generation and does not impact request-time routing.

Recommendations Update to version 4.13.5. Restrict the use of untrusted values in ssgParams to minimize the risk of file traversal during the build process.