CVE-2026-111757: Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding survives the first routing interpretation and becomes a protected path only during the later static-file decode. The affected component is serveStatic. The trigger conditions are an application protects a static prefix with upstream middleware and serveStatic receives an attacker-controlled malformed percent-encoded path. The impact is unauthorized disclosure of a static file that upstream middleware was intended to protect. The issue does not permit traversal outside the configured static root. This issue is fixed in version 4.13.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hono serveStaticto a version that resolves this vulnerability.Fixed in 4.13.11
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using Hono versions 4.12.4 through 4.13.10 are affected if they use serveStatic and rely on upstream middleware to protect a static URL prefix. Applications that do not use serveStatic, or do not protect static paths with upstream middleware, do not meet the stated trigger conditions.
What does an attacker need to exploit it?
An attacker needs network access to send a crafted request containing a malformed percent-encoded path to serveStatic. No authentication or user interaction is required, but the target application must have a protected static prefix whose middleware handling differs from serveStatic's later decoding.
What can an attacker access?
Successful exploitation can disclose a static file that upstream middleware was intended to restrict. The issue does not allow filesystem traversal outside the static root configured for serveStatic.
What should be done if updating is not immediately possible?
The provided information identifies protection of static prefixes through upstream middleware as the relevant exposure condition. Until updating to 4.13.11, review whether protected content is served through serveStatic and avoid relying on upstream middleware alone to restrict those static paths.