{"id":"CVE-2026-111757","summary":"Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths","details":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding survives the first routing interpretation and becomes a protected path only during the later static-file decode. The affected component is serveStatic. The trigger conditions are an application protects a static prefix with upstream middleware and serveStatic receives an attacker-controlled malformed percent-encoded path. The impact is unauthorized disclosure of a static file that upstream middleware was intended to protect. The issue does not permit traversal outside the configured static root. This issue is fixed in version 4.13.11.","aliases":["CVE-2026-109955","GHSA-5r4p-p66f-jhc7"],"modified":"2026-10-20T02:55:54.527354181Z","published":"2026-10-19T17:31:20.341Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-174"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111757.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111757.json"},{"type":"FIX","url":"https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc"},{"type":"ADVISORY","url":"https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111757"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/honojs/hono","events":[{"introduced":"19d20d23a2921e26c3bbfdb5549fce98b4a39b28"},{"fixed":"37ce06904e732d4bc11c9075adf362c76049a594"}],"database_specific":{"extracted_events":[{"introduced":"4.12.4"},{"fixed":"4.13.11"}],"source":"AFFECTED_FIELD"}}],"versions":["@hono/netlify@1.0.1","@hono/deno@1.0.2","@hono/deno@1.0.1","v4.13.10","v4.13.9","v4.13.8","v4.13.7","v4.13.6","v4.13.5","v4.13.4","v4.13.1","v4.13.3","v4.13.2","v4.13.0","v4.12.34","v4.12.33","v4.12.32","v4.12.31","v4.12.30","v4.12.29","v4.12.28","v4.12.27","v4.12.26","v4.12.25","v4.12.24","v4.12.23","v4.12.22","v4.12.21","v4.12.20","v4.12.19","v4.12.18","v4.12.17","v4.12.16","v4.12.15","v4.12.14","v4.12.13","v4.12.12","v4.12.11","v4.12.10","v4.12.9","v4.12.8","v4.12.7","v4.12.6","v4.12.5","v4.12.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111757.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}