CVE-2026-24472
Hono ≤ 4.11.7
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2026-24472 is a medium-severity Use of Cache Containing Sensitive Information (CWE-524) vulnerability in Hono Hono. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-12 (Session Termination) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4750
Vulnerability Data
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Middleware contains an information disclosure vulnerability caused by improper handling of HTTP cache control directives. The middleware does not respect standard cache…
more
control headers such as `Cache-Control: private` or `Cache-Control: no-store`, which may result in private or authenticated responses being cached and subsequently exposed to unauthorized users. Version 4.11.7 has a patch for the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V14.3.2
Mitigating Controls (NIST 800-53 r5) AI
AC-12 directly requires automatic session termination after a defined period, structurally preventing reuse of expired session identifiers.
Enforces access authorizations so that cached sensitive data cannot be read by actors outside the intended sphere.
Directly prevents unauthorized transfer of information through shared resources such as caches.
Controls information flows to keep sensitive data from leaving its authorized control sphere via caches.
Requires cryptographic or other protection of sensitive information at rest, which covers cached data.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Credential lifecycle management directly includes enforcing session expiration to prevent reuse.
Authorization policy enforcement and review covers terminating stale sessions to limit access scope.
Protecting confidentiality of data-at-rest covers caches that persist sensitive information.
Authentication mechanisms can incorporate session timeout checks but do not inherently address expiration policy.
Protecting data-in-use can mitigate exposure when caches hold transient sensitive values.
Logical access controls on environments reduce the chance an outsider can reach the cache.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Data leakage prevention can block unauthorized access to cached sensitive information.
Information access restriction directly limits who can read cached sensitive data.
Information deletion ensures sensitive data is removed from caches when no longer needed.
Cryptography can protect cached data at rest, but does not address access control scope.
Secure coding practices prevent caching of sensitive data outside intended boundaries.
Environment separation reduces risk of cache exposure across development/test/production.