Linux Distros Unpatched Vulnerability : CVE-2026-109955

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by...

Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

Summary serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path on...

EUVD-2026-104537

Hono: serveStatic decodes the request path a second time, leading to bypass of middleware on static paths...

GHSA-5R4P-P66F-JHC7 Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

Summary serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path on...

NPM: Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

NPM: Hono: serveStatic decodes the request path a second time, leading to bypass of middleware on static paths vulnerability discovered by ? in WordPress npm hono versions = 4.12.4, 4.13.11...

hono: hono: Information disclosure via malformed percent-encoded paths in serveStatic

A flaw was found in Hono's serveStatic middleware. This vulnerability allows a remote attacker to cause unauthorized information disclosure by bypassing path-based access controls. Because serveStatic decodes request paths a second time before performing filesystem lookups, a specially crafted...

CVE-2026-111757

A flaw was found in Hono's serveStatic middleware. This vulnerability allows a remote attacker to cause unauthorized information disclosure by bypassing path-based access controls. Because serveStatic decodes request paths a second time before performing filesystem lookups, a specially crafted...

hono: hono: Information disclosure via malformed percent-encoded paths in serveStatic

A flaw was found in Hono's serveStatic middleware. This vulnerability allows a remote attacker to cause unauthorized information disclosure by bypassing path-based access controls. Because serveStatic decodes request paths a second time before performing filesystem lookups, a specially crafted...

CVE-2026-111757

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes...

CVE-2026-111757 Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes...

CVE-2026-111757 Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes...

CVE-2026-111757

The Hono web application framework (versions 4.12.4 through 4.13.11 ) contains a vulnerability in the serveStatic component. The issue stems from double decoding a routed request path before filesystem lookup, allowing malformed percent-encoded paths to bypass upstream routing middleware. This by...

CVE-2026-111757

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes...

PT-2026-117539

Name of the Vulnerable Software and Affected Versions Hono versions 4.12.4 through 4.13.10 Description The serveStatic component in the Hono web application framework incorrectly decodes a routed request path a second time before performing a filesystem lookup. This behavior allows a malformed...

hono: hono: Security bypass via double path decoding

A flaw was found in Hono. A remote, unauthenticated attacker can exploit a double path decoding issue in the serveStatic component by submitting requests with specially crafted, encoded URL paths. This flaw allows attackers to bypass security middleware, granting unauthorized access to protected...

hono: hono: Security bypass via double path decoding

A flaw was found in Hono. A remote, unauthenticated attacker can exploit a double path decoding issue in the serveStatic component by submitting requests with specially crafted, encoded URL paths. This flaw allows attackers to bypass security middleware, granting unauthorized access to protected...

CVE-2026-109955

A flaw was found in Hono. A remote, unauthenticated attacker can exploit a double path decoding issue in the serveStatic component by submitting requests with specially crafted, encoded URL paths. This flaw allows attackers to bypass security middleware, granting unauthorized access to protected...

Double Decoding of the Same Data

Overview org.webjars.npm:hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Double Decoding of the Same Data via double URL-decoding in the serveStatic middleware, where a percent-encoded path is decoded a second time after routing. An attacker ca...

Double Decoding of the Same Data

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Double Decoding of the Same Data via double URL-decoding in the serveStatic middleware, where a percent-encoded path is decoded a second time after routing. An attacker can supply a reque...

CVE-2026-109955 Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding

Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths that the router matches in encoded form, reaching static...