honojs hono up to 4.12.24 on Windows path traversal

Summaryinfo

A vulnerability categorized as critical has been discovered in honojs hono up to 4.12.24 on Windows. This issue affects some unknown processing. Executing a manipulation can lead to path traversal. This vulnerability is tracked as CVE-2026-54286. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in honojs hono up to 4.12.24 on Windows. This vulnerability affects an unknown functionality. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality. CVE summarizes:

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the request path decodes to \, which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. This vulnerability is fixed in 4.12.25.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-54286 since 06/12/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 4.12.25 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• honojs

Name

• hono

Version

• 4.12.0
• 4.12.1
• 4.12.2
• 4.12.3
• 4.12.4
• 4.12.5
• 4.12.6
• 4.12.7
• 4.12.8
• 4.12.9
• 4.12.10
• 4.12.11
• 4.12.12
• 4.12.13
• 4.12.14
• 4.12.15
• 4.12.16
• 4.12.17
• 4.12.18
• 4.12.19
• 4.12.20
• 4.12.21
• 4.12.22
• 4.12.23
• 4.12.24

Website

• Product: https://github.com/honojs/hono/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion