CVE-2026-109955

5.3Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-174

Impact

Unauthenticated remote attackers can bypass authentication or prefix middleware to access protected static files. They only need network access to send specially crafted HTTP requests.

Root cause

Double path decoding in serveStatic allows malformed percent-encoded paths to match routing rules before decoding, bypassing prefix middleware.

Affected systems

Hono 4.12.4 before 4.13.11

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade hono to version 4.13.11 or later. If patching immediately is not possible, place authentication checks directly inside the route handler or at a reverse proxy rather than relying on prefix middleware for serveStatic routes.

shell

$ npm install hono@latest

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths that the router matches in encoded form, reaching static files without authentication checks running.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109955