The vulnerability lies in Hono's cache middleware, which ignores standard cache‑control headers such as `Cache-Control: private` and `Cache-Control: no-store`. This negligence permits private or authenticated responses to be stored in shared caches, exposing confidential data to unintended recipients. The weakness corresponds to CWE-524 and CWE-613, indicating improper handling of cache‑related security controls.

The issue affects the Hono framework from HonoJS, specifically any installation using versions earlier than 4.11.7. All releases up to and excluding 4.11.7 are vulnerable. The framework relies on JavaScript runtimes, but the root cause resides in the middleware layer of the Hono framework.

The CVSS base score of 5.3 indicates a moderate severity. Exploitability is low, with an EPSS score below 1% and no presence in the CISA KEV catalog, suggesting limited real‑world exploitation. The attack vector would be via normal HTTP traffic to a vulnerable application. An adversary could trigger the caching of sensitive responses by making authenticated requests and then retrieve the cached content through a subsequent anonymous request, resulting in the disclosure of confidential information.