CVE-2026-24472CWE-524CWE-613

Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception

Medium · published January 27, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
42.5
In the wild
Unconfirmed
What it is

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Middleware contains an information disclosure vulnerability caused by improper handling of HTTP cache control directives. The middleware does not respect standard cache control headers such as `Cache-Control: private` or `Cache-Control: no-store`, which may result in private or authenticated responses being cached and subsequently exposed to unauthorized users. Version 4.11.7 has a patch for the issue.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00508 · 42.5th percentile
Weaknesses
CWE-524 · Use of Cache Containing Sensitive Information; CWE-613 · Insufficient Session Expiration
Published
2026-01-27T19:34Z
EPSS history
Timeline
  • 27 JAN 19:34Z
    Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception
    cvelistv5