CVE-2026-111757 Details
Description
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding survives the first routing interpretation and becomes a protected path only during the later static-file decode. The affected component is serveStatic. The trigger conditions are an application protects a static prefix with upstream middleware and serveStatic receives an attacker-controlled malformed percent-encoded path. The impact is unauthorized disclosure of a static file that upstream middleware was intended to protect. The issue does not permit traversal outside the configured static root. This issue is fixed in version 4.13.11.
A vulnerability in the Hono web application framework, specifically in the serveStatic middleware, allows for the unauthorized disclosure of static files that should be protected by upstream routing middleware. This issue affects Hono versions 4.12.4 prior to 4.13.11. The vulnerability arises because serveStatic decodes the request path a second time before looking up files, creating a scenario where malformed percent-encoded paths can bypass static prefix protections. The flaw does not allow traversal outside the designated static root.
Users can upgrade to Hono version 4.13.11 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc | [email protected] | Source CodeVendor |
| https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-174 | Double Decoding of the Same Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Hono | >= 4.12.4, < 4.13.11 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |