{"id":"GHSA-wwfh-h76j-fc44","revision":"1feccc3f67fe48d39a48fc5bef04df7c","records":[{"revision":"1feccc3f67fe48d39a48fc5bef04df7c","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-wwfh-h76j-fc44","aliases":["CVE-2026-54286"],"title":"hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)","description":"### Summary\n\nOn Windows hosts, an encoded backslash (`%5C`) in the request path decodes to `\\`, which the Windows path resolver treats as a separator. `serve-static` then resolves a single URL segment such as `admin\\secret.txt` into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. Directory escape (`..`) remains blocked.\n\n### Details\n\nThe router splits paths only on `/`, so `/admin%5Csecret.txt` is one segment and middleware on `/admin/*` does not run. The `serve-static` guard rejects `.`/`..` and consecutive separators but lets a lone `\\` through; on Windows the file resolver re-splits it into the protected subtree.\n\nThis affects Windows hosts serving static files via the Node, Bun, or Deno adapters that guard a static subtree with prefix-mounted middleware.\n\n### Impact\n\nAn unauthenticated attacker can read static files under a middleware-guarded prefix on Windows hosts. The read stays within the configured root; escape outside the root is not possible.","state":0,"publishedAt":"2026-06-16T14:09:03+00:00","modifiedAt":"2026-09-10T03:50:51.0499205+00:00","affected":[{"ecosystem":"npm","name":"hono","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.12.25"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44","https://nvd.nist.gov/vuln/detail/CVE-2026-54286","https://github.com/honojs/hono"],"sourceUrl":"https://github.com/advisories/GHSA-wwfh-h76j-fc44","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-wwfh-h76j-fc44","identifiers":["GHSA-wwfh-h76j-fc44","CVE-2026-54286"]},"retained":false,"historicalAffected":[]}],"coverage":[]}