PT-2026-111550 · Hono · Hono
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Hono versions 4.12.4 through 4.13.10
Description
A middleware bypass exists in the
serveStatic function. Unauthenticated attackers can bypass prefix middleware by using double path decoding, sending malformed percent-encoded paths that the router matches in encoded form. This allows unauthorized access to static files by skipping authentication checks.Recommendations
Update Hono to version 4.13.11 or later.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Hono