CVE-2026-109955: Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding
Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths that the router matches in encoded form, reaching static files without authentication checks running.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Honoto a version that resolves this vulnerability.Fixed in 4.13.11
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using npm/hono versions from 4.12.4 before 4.13.11 are affected when they use serveStatic with prefix middleware intended to enforce authentication or other access checks for static content.
What does an attacker need to exploit the bypass?
An attacker does not need authentication or user interaction. They can send a malformed percent-encoded path that is matched by the router in encoded form, allowing access to static files without the prefix middleware running.
What is the practical impact of successful exploitation?
The vulnerability can expose static files that were expected to be protected by prefix middleware. The provided assessment indicates limited confidentiality impact and no stated integrity or availability impact.
How can I determine whether my application is affected?
Check whether the application uses Hono 4.12.4 through versions earlier than 4.13.11, uses serveStatic, and relies on prefix middleware to protect paths serving static files. Applications without that middleware and static-file configuration are not identified as affected by the provided information.