CVE-2026-109955

A flaw was found in Hono. A remote, unauthenticated attacker can exploit a double path decoding issue in the serveStatic component by submitting requests with specially crafted, encoded URL paths. This flaw allows attackers to bypass security middleware, granting unauthorized access to protected...