Executive brief
Hono's cache middleware is a caching layer used by developers to speed up web applications. The middleware fails to respect HTTP "Cache-Control: private" headers, causing sensitive user data and authenticated responses to be cached and served to unauthorized users. This can expose personally identifiable information, session tokens, or other private data to attackers who request the same URL.
Technical details
The vulnerability is an information disclosure issue (CWE-524, CWE-613) in the cache decision logic of Hono's cache middleware. When determining whether to cache a response, the middleware ignores HTTP cache control semantics and does not respect Cache-Control: private or Cache-Control: no-store directives. This allows authenticated or sensitive responses to be cached globally. The attack requires no authentication or user interaction and is network-reachable. On runtimes like Node.js, Deno, and Bun that rely on the middleware for cache control enforcement (unlike Cloudflare Workers which enforces it at the platform level), an attacker can request a URL previously accessed by an authenticated user and receive the cached private response, exposing PII or session data. The vulnerability is fixed in version 4.11.7.
Affected products
- Hono Hono < 4.11.7
Timeline
- 2026-01-27: disclosed
- 2026-01-27: patched: Fixed in version 4.11.7