CVE-2026-111757

Name of the Vulnerable Software and Affected Versions Hono versions 4.12.4 through 4.13.10

Description The serveStatic component in the Hono web application framework incorrectly decodes a routed request path a second time before performing a filesystem lookup. This behavior allows a malformed percent-encoded path to bypass protection mechanisms implemented by upstream routing middleware. When an application protects a static prefix using such middleware, an attacker can provide a specifically crafted malformed percent-encoded path that survives the initial routing check but is decoded into a protected path during the static-file lookup. This can lead to the unauthorized disclosure of static files, although it does not allow traversal outside the configured static root.

Recommendations Update to version 4.13.11. As a temporary mitigation, restrict access to the serveStatic component or ensure that input validation is applied to request paths before they reach the static file handler.