1189 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-109955
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by...
Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
Summary serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path on...
EUVD-2026-104537
Hono: serveStatic decodes the request path a second time, leading to bypass of middleware on static paths...
GHSA-5R4P-P66F-JHC7 Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
Summary serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path on...
NPM: Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
NPM: Hono: serveStatic decodes the request path a second time, leading to bypass of middleware on static paths vulnerability discovered by ? in WordPress npm hono versions = 4.12.4, 4.13.11...
hono: hono: Information disclosure via malformed percent-encoded paths in serveStatic
A flaw was found in Hono's serveStatic middleware. This vulnerability allows a remote attacker to cause unauthorized information disclosure by bypassing path-based access controls. Because serveStatic decodes request paths a second time before performing filesystem lookups, a specially crafted...
CVE-2026-111757
A flaw was found in Hono's serveStatic middleware. This vulnerability allows a remote attacker to cause unauthorized information disclosure by bypassing path-based access controls. Because serveStatic decodes request paths a second time before performing filesystem lookups, a specially crafted...
hono: hono: Information disclosure via malformed percent-encoded paths in serveStatic
A flaw was found in Hono's serveStatic middleware. This vulnerability allows a remote attacker to cause unauthorized information disclosure by bypassing path-based access controls. Because serveStatic decodes request paths a second time before performing filesystem lookups, a specially crafted...
CVE-2026-111757
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes...
CVE-2026-111757 Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes...
CVE-2026-111757
The Hono web application framework (versions 4.12.4 through 4.13.11 ) contains a vulnerability in the serveStatic component. The issue stems from double decoding a routed request path before filesystem lookup, allowing malformed percent-encoded paths to bypass upstream routing middleware. This by...
CVE-2026-111757
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes...
CVE-2026-111757 Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes...
roninforge-hono
roninforge-hono Cursor plugin for Hono v4 TypeScript edge web framework + TypeScript. Pinned to hono ^4.12.19, @hono/zod-validator ^0.8.0, @hono/zod-openapi ^1.4.0 peer zod ^4.x, @hono/node-server ^2.0.3 Node 20+. Teaches the v4 APIs that LLMs trained on pre-2024 data do not know c.json always...
PT-2026-117539
Name of the Vulnerable Software and Affected Versions Hono versions 4.12.4 through 4.13.10 Description The serveStatic component in the Hono web application framework incorrectly decodes a routed request path a second time before performing a filesystem lookup. This behavior allows a malformed...
hono: hono: Security bypass via double path decoding
A flaw was found in Hono. A remote, unauthenticated attacker can exploit a double path decoding issue in the serveStatic component by submitting requests with specially crafted, encoded URL paths. This flaw allows attackers to bypass security middleware, granting unauthorized access to protected...
hono: hono: Security bypass via double path decoding
A flaw was found in Hono. A remote, unauthenticated attacker can exploit a double path decoding issue in the serveStatic component by submitting requests with specially crafted, encoded URL paths. This flaw allows attackers to bypass security middleware, granting unauthorized access to protected...
EUVD-2026-102508
ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE...
CVE-2026-111368
ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE...
CVE-2026-111368 ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes
ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE...