{"id":"EUVD-2026-38327","enisaUuid":"6fce11b1-ce3b-36f0-a050-65acdf66d90b","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the request path decodes to \\, which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. This vulnerability is fixed in 4.12.25.","datePublished":"Jun 22, 2026, 5:14:40 PM","dateUpdated":"Jun 23, 2026, 2:07:34 PM","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44\n","aliases":"CVE-2026-54286\nGHSA-wwfh-h76j-fc44\n","assigner":"GitHub_M","epss":0.43,"enisaIdProduct":[{"id":"cbb5682c-8ef1-3ae3-af39-cf1bcad56e55","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"\u003c 4.12.25"}],"enisaIdVendor":[{"id":"9a1ef1f0-01ac-3616-8b9f-0e9f304b68c6","vendor":{"name":"honojs"}}],"enisaIdVulnerability":[{"id":"a6293f2b-b428-30b7-972f-024fae7f8078","vulnerability":{"id":"CVE-2026-54286","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the request path decodes to \\, which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. This vulnerability is fixed in 4.12.25.","datePublished":"Jun 22, 2026, 5:14:40 PM","dateUpdated":"Jun 23, 2026, 2:07:34 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44\n","enisa_id":"EUVD-2026-38327\n","assigner":"GitHub_M","epss":0.43,"dataProcessed":"Nov 7, 2026, 7:20:27 AM","vulnerabilityProduct":[{"id":"6968c3b3-21d0-3a73-830a-3c5e82c713dc","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"\u003c 4.12.25"}],"vulnerabilityVendor":[{"id":"756f3a59-3133-3e55-9d6f-d23dd063c0cf","vendor":{"name":"honojs"}}]}},{"id":"bdd0ec9c-d01a-30c3-811c-d3579eac196c","vulnerability":{"id":"GHSA-wwfh-h76j-fc44","description":"hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)","datePublished":"Jun 16, 2026, 2:09:03 PM","dateUpdated":"Jul 21, 2026, 3:27:07 PM","baseScore":0.0,"references":"https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54286\nhttps://github.com/honojs/hono\n","enisa_id":"EUVD-2026-38327\n","aliases":"GHSA-wwfh-h76j-fc44\nCVE-2026-54286\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}