MEDIUM 6.9 NVD
CVE-2026-109955
Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exp
Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths that the router matches in encoded form, reaching static files without authentication checks running.
References
- https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7
- https://www.vulncheck.com/advisories/hono-4.12.4-before-4.13.11-middleware-bypass-via-serv
This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-10-13 via NVD.
vulnfeed aggregates 13242 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.