CVE-2026-111757
Deferred Deferred - Pending Action

Path Traversal in Hono serveStatic via Double Percent-Encoding

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding survives the first routing interpretation and becomes a protected path only during the later static-file decode. The affected component is serveStatic. The trigger conditions are an application protects a static prefix with upstream middleware and serveStatic receives an attacker-controlled malformed percent-encoded path. The impact is unauthorized disclosure of a static file that upstream middleware was intended to protect. The issue does not permit traversal outside the configured static root. This issue is fixed in version 4.13.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-111757
EUVD
EUVD-2026-104537

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
honojs hono >= 4.12.4, < 4.13.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-174 The product decodes the same input twice, which can limit the effectiveness of any protection mechanism that occurs in between the decoding operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the serveStatic function in the Hono web framework. It occurs because serveStatic decodes the request path a second time after Hono has already decoded it for routing. This double decoding allows an attacker to craft a request where the first decode leaves part of the path encoded, causing the router to match the encoded form while the second decode resolves the actual file path. This can bypass security checks like authentication.

Detection Guidance

To detect this vulnerability, check if your Hono application uses serveStatic middleware with versions between 4.12.4 and 4.13.10. Inspect network logs for requests with malformed percent-encoded paths targeting static file routes. Test with crafted paths like /static/%%36%31dmin/secret.txt to see if unauthorized files are accessible.

Impact Analysis

An attacker could bypass protections set up by upstream middleware, such as authentication, and gain unauthorized access to static files that were meant to be protected. This does not allow traversal outside the configured static root but could expose sensitive files within the static directory.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive files, potentially violating data protection requirements under GDPR or HIPAA. If protected static files containing personal or health data are exposed, it may result in compliance breaches and legal consequences.

Mitigation Strategies

Upgrade Hono to version 4.13.11 or later. If upgrading is not immediately possible, disable serveStatic or restrict access to static routes using upstream middleware. Avoid using the allowPercentInPath option unless explicitly required for compatibility.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111757. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart