{"id":"CVE-2026-109955","summary":"Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding","details":"Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths that the router matches in encoded form, reaching static files without authentication checks running.","aliases":["GHSA-5r4p-p66f-jhc7"],"modified":"2026-10-15T02:47:23.632822828Z","published":"2026-10-13T13:27:19.610Z","database_specific":{"cwe_ids":["CWE-174"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109955.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109955.json"},{"type":"ADVISORY","url":"https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109955"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/hono-4.12.4-before-4.13.11-middleware-bypass-via-servestatic-double-decoding"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/honojs/hono","events":[{"introduced":"19d20d23a2921e26c3bbfdb5549fce98b4a39b28"},{"fixed":"37ce06904e732d4bc11c9075adf362c76049a594"}],"database_specific":{"source":["AFFECTED_FIELD","DESCRIPTION"],"extracted_events":[{"introduced":"4.12.4"},{"fixed":"4.13.11"}]}}],"versions":["@hono/netlify@1.0.1","@hono/deno@1.0.2","@hono/deno@1.0.1","v4.13.10","v4.13.9","v4.13.8","v4.13.7","v4.13.6","v4.13.5","v4.13.4","v4.13.1","v4.13.3","v4.13.2","v4.13.0","v4.12.34","v4.12.33","v4.12.32","v4.12.31","v4.12.30","v4.12.29","v4.12.28","v4.12.27","v4.12.26","v4.12.25","v4.12.24","v4.12.23","v4.12.22","v4.12.21","v4.12.20","v4.12.19","v4.12.18","v4.12.17","v4.12.16","v4.12.15","v4.12.14","v4.12.13","v4.12.12","v4.12.11","v4.12.10","v4.12.9","v4.12.8","v4.12.7","v4.12.6","v4.12.5","v4.12.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109955.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}