CVE-2026-111757 in Hono
Summary
by MITRE • 10/19/2026
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding survives the first routing interpretation and becomes a protected path only during the later static-file decode. The affected component is serveStatic. The trigger conditions are an application protects a static prefix with upstream middleware and serveStatic receives an attacker-controlled malformed percent-encoded path. The impact is unauthorized disclosure of a static file that upstream middleware was intended to protect. The issue does not permit traversal outside the configured static root. This issue is fixed in version 4.13.11.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified within Hono versions 4.12.4 through 4.13.11 represents a critical logic flaw in the serveStatic middleware component, specifically concerning how percent-encoded URL paths are processed during static file serving operations. This issue arises from an inconsistency between the path interpretation performed by upstream routing middleware and that of the serveStatic handler itself. In typical web application architectures using Hono, developers often implement security measures such as authentication checks or access control lists via middleware layers positioned before the final request handlers. These upstream components are designed to inspect incoming requests and block unauthorized access to specific routes or prefixes. However, when a request targets static assets served by serveStatic, the framework exhibits divergent behavior in path decoding that allows attackers to circumvent these protective barriers.
The technical root cause of this vulnerability lies in the double-decoding mechanism employed by serveStatic during filesystem lookups. When an HTTP request arrives with a percent-encoded URL, such as one containing encoded slashes or dots intended to bypass directory traversal protections, upstream routing middleware typically performs a single round of decoding to determine which route matches the incoming path. If the application relies on this decoded path for security decisions, it assumes that any special characters have been normalized and interpreted correctly by the router. However, serveStatic internally decodes the request path a second time before attempting to locate the corresponding file on the disk. This secondary decoding step can transform encoded sequences into their literal character equivalents in a way that differs from how the upstream middleware processed them initially. Consequently, an attacker can craft a malformed percent-encoded path that appears benign or restricted during the routing phase but resolves to a sensitive resource after the second decode operation within serveStatic.
This discrepancy enables an unauthorized disclosure of static files that were explicitly intended to be protected by upstream middleware. For instance, if an application uses middleware to restrict access to a directory containing configuration files or internal assets, an attacker can exploit this encoding inconsistency to retrieve those files without proper authentication or authorization. The attack mechanism relies on the fact that the malformed percent-encoding survives the initial routing interpretation phase and only becomes effective during the later static-file decode stage. It is important to note that while this vulnerability allows for the bypass of access controls, it does not permit arbitrary directory traversal outside the configured static root directory. This limitation means that an attacker cannot read files from system locations beyond the designated public or asset folders, thereby containing the blast radius primarily to resources within the web-accessible directory structure.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-798 Use of Hard-coded Credentials if sensitive static assets contain credentials, though it is most accurately described as an Access Control Bypass due to inconsistent path normalization. In terms of the MITRE ATT&CK framework, this behavior facilitates Initial Access or Credential Access depending on the nature of the exposed files, specifically mapping to techniques involving Obfuscated Files or Information where attackers use encoding schemes to evade detection and security controls. The operational impact is significant for applications that rely heavily on middleware-based access control for static content, as it undermines the integrity of those security boundaries without requiring complex exploitation chains beyond crafting specific HTTP requests with carefully constructed URL parameters.
To mitigate this vulnerability, organizations running Hono versions 4.12.4 through 4.13.11 must upgrade to version 4.13.11 or later immediately. The fix addresses the inconsistency by ensuring that serveStatic handles percent-encoded paths in a manner consistent with upstream routing middleware, thereby preventing the double-decoding bypass. In environments where upgrading is not immediately feasible, developers should implement additional validation layers that normalize and validate request paths before they reach any static file serving logic. This includes enforcing strict allowlists for permitted characters or ensuring that all input undergoes canonicalization checks to detect and reject malformed encodings that could lead to unauthorized access. Regular security audits of middleware ordering and path handling logic are recommended to prevent similar inconsistencies in other parts of the application stack.