{"id":"EUVD-2026-98659","enisaUuid":"0034bcbe-22c6-3022-b572-5184d1ee0678","description":"Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths that the router matches in encoded form, reaching static files without authentication checks running.","datePublished":"Oct 13, 2026, 1:27:19 PM","dateUpdated":"Oct 13, 2026, 1:51:43 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7\nhttps://www.vulncheck.com/advisories/hono-4.12.4-before-4.13.11-middleware-bypass-via-servestatic-double-decoding\n","aliases":"CVE-2026-109955\nGHSA-3g9q-qwv8-cxpf\n","assigner":"VulnCheck","epss":0.32,"enisaIdProduct":[{"id":"5306cfd7-6e48-3106-bf3b-8cb24179c60e","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"4.12.4 \u003c4.13.11"}],"enisaIdVendor":[{"id":"cbb65afd-bf6f-3eb4-94bf-07c6b59568ac","vendor":{"name":"honojs"}}],"enisaIdVulnerability":[{"id":"a6150081-47d8-396a-a304-bcaa559e5c50","vulnerability":{"id":"CVE-2026-109955","description":"Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths that the router matches in encoded form, reaching static files without authentication checks running.","datePublished":"Oct 13, 2026, 1:27:19 PM","dateUpdated":"Oct 13, 2026, 1:51:43 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7\nhttps://www.vulncheck.com/advisories/hono-4.12.4-before-4.13.11-middleware-bypass-via-servestatic-double-decoding\n","enisa_id":"EUVD-2026-98659\n","assigner":"VulnCheck","epss":0.32,"dataProcessed":"Oct 27, 2026, 7:17:47 AM","vulnerabilityProduct":[{"id":"4464b30f-118b-3dcf-a2b1-7c162b78f736","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"4.12.4 \u003c4.13.11"}],"vulnerabilityVendor":[{"id":"5da315f8-a1b9-3282-b726-52198803cb91","vendor":{"name":"honojs"}}]}},{"id":"cd72d3b0-9393-34d6-afe7-75352c5827a0","vulnerability":{"id":"GHSA-3g9q-qwv8-cxpf","description":"Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths that the router matches in encoded form, reaching static files without authentication checks running.","datePublished":"Oct 13, 2026, 3:32:23 PM","dateUpdated":"Oct 13, 2026, 3:32:23 PM","baseScore":0.0,"references":"https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-109955\nhttps://www.vulncheck.com/advisories/hono-4.12.4-before-4.13.11-middleware-bypass-via-servestatic-double-decoding\n","enisa_id":"EUVD-2026-98659\n","aliases":"GHSA-3g9q-qwv8-cxpf\nCVE-2026-109955\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:03:05 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"23c3f2a1-79a2-3b7b-ab57-63d663d3649d","advisory":{"id":"RHSA-2026:84431","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 17, 2026, 7:35:07 PM","dateUpdated":"Oct 17, 2026, 8:48:16 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:84431\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84431.json\n","aliases":"CVE-2026-109955\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"105ce0e5-1315-33ce-90d3-709e159ce9d6","product":{"name":"grafana13.2-0:13.2.3-0.2.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"480993f0-72ec-3052-b043-3cf9b448494e","product":{"name":"grafana13.2-0:13.2.3-0.2.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"a06eb518-ea18-326e-aa71-6264f4db9049","product":{"name":"grafana13.2-0:13.2.3-0.2.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"e9d13b86-b2e1-3f70-8076-da52cfd9b94d","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"ee715e16-cd04-3d65-8c14-240a41b383f3","product":{"name":"grafana13.2-0:13.2.3-0.2.hum1@aarch64","vendor":{"name":"Red Hat"}}}]}},{"id":"3160fa4b-faa2-3d4d-90f0-456af3e2417b","advisory":{"id":"RHSA-2026:84423","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 17, 2026, 6:18:14 PM","dateUpdated":"Oct 17, 2026, 8:48:10 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:84423\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84423.json\n","aliases":"CVE-2026-109955\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"60aab482-9754-3129-8912-4acda9c830e9","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"7a7c0f04-5964-3506-a54d-3117405dc5d7","product":{"name":"grafana13.1-0:13.1.7-0.2.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"86fdba4d-aa8b-3876-8733-31e980c5f0ab","product":{"name":"grafana13.1-0:13.1.7-0.2.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"87ac6e1b-6ecf-3719-be30-ac5fe0654468","product":{"name":"grafana13.1-0:13.1.7-0.2.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"bfd36146-4f9d-3346-b3b9-92dce82ff616","product":{"name":"grafana13.1-0:13.1.7-0.2.hum1@src","vendor":{"name":"Red Hat"}}}]}},{"id":"db06bd6c-417b-3a85-a6de-ca6c284e63cf","advisory":{"id":"RHSA-2026:84422","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 17, 2026, 6:08:49 PM","dateUpdated":"Oct 17, 2026, 8:48:15 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:84422\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84422.json\n","aliases":"CVE-2026-109955\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"6df0a6e8-721d-3ae2-9279-058a643d094f","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"6eac96bc-0c18-3267-98dc-a03e1324ff10","product":{"name":"grafana12.4-0:12.4.12-0.5.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"b218e422-f5d1-3ece-b6d9-bc4493c6cf94","product":{"name":"grafana12.4-0:12.4.12-0.5.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"fee64154-7bfe-3b0b-b0e9-3010c8d67fda","product":{"name":"grafana12.4-0:12.4.12-0.5.hum1@src","vendor":{"name":"Red Hat"}}}]}}]}