{"id":"EUVD-2026-104537","enisaUuid":"41c8ccd3-2e14-34ab-bb9e-f0762f3eb77f","description":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding survives the first routing interpretation and becomes a protected path only during the later static-file decode. The affected component is serveStatic. The trigger conditions are an application protects a static prefix with upstream middleware and serveStatic receives an attacker-controlled malformed percent-encoded path. The impact is unauthorized disclosure of a static file that upstream middleware was intended to protect. The issue does not permit traversal outside the configured static root. This issue is fixed in version 4.13.11.","datePublished":"Oct 19, 2026, 5:31:20 PM","dateUpdated":"Oct 20, 2026, 4:10:30 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7\nhttps://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7\nhttps://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc\n","aliases":"CVE-2026-111757\nGHSA-5r4p-p66f-jhc7\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"850592a4-ef83-3ef6-bb52-1a14e0408cb2","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"4.12.4, \u003c 4.13.11"}],"enisaIdVendor":[{"id":"2ab613d2-bdcc-3c5a-9909-3805cff65cb1","vendor":{"name":"honojs"}}],"enisaIdVulnerability":[{"id":"dc09a869-0215-3284-9aa4-02e0e63d3af4","vulnerability":{"id":"GHSA-5r4p-p66f-jhc7","description":"Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths","datePublished":"Oct 20, 2026, 2:36:11 PM","dateUpdated":"Oct 20, 2026, 2:36:11 PM","baseScore":0.0,"references":"https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-111757\nhttps://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc\nhttps://github.com/honojs/hono\nhttps://github.com/honojs/hono/releases/tag/v4.13.11\n","enisa_id":"EUVD-2026-104537\n","aliases":"GHSA-5r4p-p66f-jhc7\nCVE-2026-111757\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:08:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f9879a63-b6c7-39a2-8d73-28a045c873f3","vulnerability":{"id":"CVE-2026-111757","description":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding survives the first routing interpretation and becomes a protected path only during the later static-file decode. The affected component is serveStatic. The trigger conditions are an application protects a static prefix with upstream middleware and serveStatic receives an attacker-controlled malformed percent-encoded path. The impact is unauthorized disclosure of a static file that upstream middleware was intended to protect. The issue does not permit traversal outside the configured static root. This issue is fixed in version 4.13.11.","datePublished":"Oct 19, 2026, 5:31:20 PM","dateUpdated":"Oct 20, 2026, 4:10:30 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7\nhttps://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7\nhttps://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc\n","enisa_id":"EUVD-2026-104537\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Nov 1, 2026, 4:02:12 AM","vulnerabilityProduct":[{"id":"144ae1fa-3737-37aa-9196-cdef532decef","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"4.12.4, \u003c 4.13.11"}],"vulnerabilityVendor":[{"id":"3f8af4d7-2d9f-354a-84c4-3c9956985fa2","vendor":{"name":"honojs"}}]}}],"enisaIdAdvisory":[{"id":"02dc9e40-43ac-38bc-bbc0-74cb7b272963","advisory":{"id":"RHSA-2026:84423","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 17, 2026, 6:18:14 PM","dateUpdated":"Oct 30, 2026, 6:54:41 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:84423\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84423.json\n","aliases":"CVE-2026-109955\nCVE-2026-111757\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"60aab482-9754-3129-8912-4acda9c830e9","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"7a7c0f04-5964-3506-a54d-3117405dc5d7","product":{"name":"grafana13.1-0:13.1.7-0.2.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"86fdba4d-aa8b-3876-8733-31e980c5f0ab","product":{"name":"grafana13.1-0:13.1.7-0.2.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"87ac6e1b-6ecf-3719-be30-ac5fe0654468","product":{"name":"grafana13.1-0:13.1.7-0.2.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"bfd36146-4f9d-3346-b3b9-92dce82ff616","product":{"name":"grafana13.1-0:13.1.7-0.2.hum1@src","vendor":{"name":"Red Hat"}}}]}},{"id":"12f23eef-eb00-31b1-8f36-27446b98df67","advisory":{"id":"RHSA-2026:85295","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 19, 2026, 7:47:23 PM","dateUpdated":"Oct 29, 2026, 12:47:23 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:85295\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85295.json\n","aliases":"CVE-2026-92539\nCVE-2026-93294\nCVE-2026-111757\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"11aa30c0-0bba-3439-842c-865025527432","product":{"name":"grafana12.4-0:12.4.13-0.1.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"5aa0c66e-9fb3-3d9e-9738-4a04fe162705","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"725ce65d-a0e2-3d39-a83b-a3a38e5029e0","product":{"name":"grafana12.4-0:12.4.13-0.1.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"b748063a-65a1-375b-82af-24f16c05c9bc","product":{"name":"grafana12.4-0:12.4.13-0.1.hum1@aarch64","vendor":{"name":"Red Hat"}}}]}},{"id":"f85b90d4-d685-3de1-a08e-7a1acbc063f0","advisory":{"id":"RHSA-2026:85544","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 19, 2026, 9:42:26 PM","dateUpdated":"Oct 29, 2026, 4:14:12 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:85544\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85544.json\n","aliases":"CVE-2026-15577\nCVE-2026-33374\nCVE-2026-92539\nCVE-2026-93294\nCVE-2026-95502\nCVE-2026-111757\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"cd19ed54-631b-34e4-b207-bffb9e1e34e7","product":{"name":"grafana13.2-0:13.2.4-0.1.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"ea6f162a-f611-38ef-9da6-16d628a9b473","product":{"name":"grafana13.2-0:13.2.4-0.1.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"eee46062-e566-36b7-813a-1963d49ab16c","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"ef97f357-57ed-301c-a79a-a7c9286d8d0f","product":{"name":"grafana13.2-0:13.2.4-0.1.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"fc48fac2-cced-3c18-a888-ed3f53098cca","product":{"name":"grafana13.2-0:13.2.4-0.1.hum1@x86_64","vendor":{"name":"Red Hat"}}}]}}]}