Hono, a web application framework for JavaScript runtimes, contains an information disclosure flaw in its Serve static Middleware when used with the Cloudflare Workers adapter. Malicious actors can craft request paths that are improperly validated, allowing them to read arbitrary keys from the Workers environment. This vulnerability permits disclosure of internal asset keys and potentially other sensitive data stored as environment variables, thereby compromising confidentiality of the application.

The vulnerability affects all installations of the honojs:hono framework running a version older than 4.11.7, specifically when the Serve static Middleware for the Cloudflare Workers adapter is enabled. It is identified by the use of the honojs:hono product on a Node.js runtime.

The CVSS score of 6.3 indicates a moderate severity, while an EPSS probability of less than 1% suggests that exploitation is currently unlikely in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to send specially crafted requests to a Cloudflare Workers instance running vulnerable Hono code, exploiting the path validation flaw to trigger unintended access to internal keys. The attack vector is inferred to be remote, via HTTP requests, based on the nature of Serve static Middleware and the description of the flaw.