CVE-2026-39408

A path traversal issue in toSSG() allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via ssgParams, specially crafted values can cause generated file paths to escape the intended output directory.

Details

The static site generation process creates output files based on route paths derived from application routes and parameters. When ssgParams is used to provide values for dynamic routes, those values are used to construct output file paths. If these values contain traversal sequences (e.g. ..), the resulting output path may resolve outside the configured output directory. As a result, files may be written to unintended locations instead of being confined within the specified output directory.

For example:

import { Hono } from 'hono'
import { toSSG, ssgParams } from 'hono/ssg'

const app = new Hono()

app.get('/:id', ssgParams([{ id: '../pwned' }]), (c) => {
  return c.text('pwned')
})

toSSG(app, fs, { dir: './static' })

In this case, the generated output path may resolve outside ./static, resulting in a file being written outside the intended output directory.

An attacker who can influence values passed to ssgParams during the build process may be able to write files outside the intended output directory.

Depending on the build and deployment environment, this may:

• overwrite unintended files
• affect generated artifacts
• impact deployment outputs or downstream tooling

This issue is limited to build-time static site generation and does not affect request-time routing.

Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.

Kodem intelligence

1. What is CVE-2026-39408? CVE-2026-39408 is a medium-severity path traversal vulnerability in hono (npm), affecting versions >= 4.0.0, <= 4.12.11. It is fixed in 4.12.12. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
2. Which versions of hono are affected by CVE-2026-39408? hono (npm) versions >= 4.0.0, <= 4.12.11 is affected.
3. Is there a fix for CVE-2026-39408? Yes. CVE-2026-39408 is fixed in 4.12.12. Upgrade to this version or later.
4. Is CVE-2026-39408 exploitable, and should I be worried? Whether CVE-2026-39408 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-39408 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-39408? Upgrade hono to 4.12.12 or later.