5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24472

CVE-2026-24472: Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Middleware contains an information disclosure vulnerability caused by improper handling of HTTP cache control directives. The middleware does not respect standard cache control headers such as Cache-Control: private or Cache-Control: no-store, which may result in private or authenticated responses being cached and subsequently exposed to unauthorized users. Version 4.11.7 has a patch for the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24472

CVE-2026-24472:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hono	npm	< 4.11.7	4.11.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided security patch (commit 12c511745b3f1e7a3f863a23ce5f921c7fa805d1) clearly indicates that the vulnerability is located in the shouldSkipCache function within src/middleware/cache/index.ts. The vulnerability description states that the cache middleware improperly handles HTTP cache control directives, leading to the caching of private information. The commit diff shows that the shouldSkipCache function was modified to correctly handle these directives. Before the patch, the function only checked for Vary: *. The patch adds logic to also check for Cache-Control headers (like private, no-store, no-cache) and the Set-Cookie header. If any of these are present, the function now correctly returns true, preventing the response from being cached. The added test cases in src/middleware/cache/index.test.ts further confirm that this was the intended fix for the vulnerability. Therefore, the shouldSkipCache function is the precise location of the flawed logic that causes the Web Cache Deception vulnerability.

Vulnerable functions

shouldSkipCache

src/middleware/cache/index.ts

The vulnerability lies in the `shouldSkipCache` function, which is responsible for deciding whether a response should be cached. Prior to the patch, this function only checked if the 'Vary' header contained an asterisk ('*'). It did not check for 'Cache-Control' directives such as 'private', 'no-store', or 'no-cache', nor did it check for the presence of a 'Set-Cookie' header. As a result, the function would incorrectly return `false` for responses containing sensitive data but marked as private, allowing the cache middleware to store them. This could lead to the disclosure of this sensitive information to other users.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.