CVE-2026-109955 — Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding
Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double pa…
Published: 2026-10-13 · CVSS: 6.9 · CVSS 4.0
Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths that the router matches in encoded form, reaching static files without authentication checks running.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7