Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-109955 · Microsoft / collected KEV context

CVE-2026-111757 · Microsoft / collected KEV context

EUVD-2026-104537

GHSA-5r4p-p66f-jhc7

EUVD-2026-98659

GHSA-3g9q-qwv8-cxpf

cve-program · CVE-2026-109955

• https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7
• https://www.vulncheck.com/advisories/hono-4.12.4-before-4.13.11-middleware-bypass-via-servestatic-double-decoding

cve-program · CVE-2026-111757

• https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7
• https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc

euvd · EUVD-2026-104537

• https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7
• https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc

euvd · EUVD-2026-98659

• https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7
• https://www.vulncheck.com/advisories/hono-4.12.4-before-4.13.11-middleware-bypass-via-servestatic-double-decoding

nvd · CVE-2026-109955

• https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7
• https://www.vulncheck.com/advisories/hono-4.12.4-before-4.13.11-middleware-bypass-via-servestatic-double-decoding

nvd · CVE-2026-111757

• https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc
• https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7

osv · GHSA-5r4p-p66f-jhc7

• https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7
• https://nvd.nist.gov/vuln/detail/CVE-2026-111757
• https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc
• https://github.com/honojs/hono
• https://github.com/honojs/hono/releases/tag/v4.13.11

• Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection f… · Advisory content revised · 1 Nov 2026
• Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths… · Advisory content revised · 1 Nov 2026