{"id":"CVE-2026-29045","aliases":["CLSA-2026-1792232996","EUVD-2026-9506","GHSA-q5qw-h33p-qvwr","ROOT-APP-NPM-CVE-2026-29045"],"status":"published","title":"Hono: Arbitrary file access via serveStatic vulnerability","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path. This issue has been patched in version 4.12.4.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00587,"percentile":0.48369,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-177"],"published":"2026-03-04T19:48:00Z","modified":"2026-10-28T02:31:00Z","fixes":[{"ecosystem":"npm","package":"hono","fixed_in":["4.12.4"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"@rootio/hono","fixed_in":["4.11.7-root.io.1","4.11.7-root.io.2","4.11.7-root.io.3","4.11.7-root.io.4","4.11.7-root.io.5","4.11.7-root.io.6"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"hono","fixed_in":["4.11.7-aikido.5","4.11.7-aikido.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"hono","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"hono","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.12-tuxcare.0"},{"fixed":"3.12.12-tuxcare.4"}]}],"versions":["3.12.12","3.12.12-tuxcare.1","3.12.12-tuxcare.2","3.12.12-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"hono","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.12.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/hono","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.7-root.io.1"},{"fixed":"4.11.7-root.io.2"},{"fixed":"4.11.7-root.io.3"},{"fixed":"4.11.7-root.io.4"},{"fixed":"4.11.7-root.io.5"},{"fixed":"4.11.7-root.io.6"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"hono","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.7-aikido.5"},{"fixed":"4.11.7-aikido.6"}]}]}],"products":[{"vendor":"hono","product":"hono"},{"vendor":"honojs","product":"hono"}],"references":[{"url":"https://github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/honojs/hono/commit/6a0607a929d888893f0c91d92dce2fcfdb3662a3","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29045","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q5qw-h33p-qvwr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29045.json","tags":["advisory"]},{"url":"https://github.com/honojs/hono","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-29045","title":"Hono: Arbitrary file access via serveStatic vulnerability","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path. This issue has been patched in version 4.12.4.","status":"published","published":"2026-03-04T22:09:22.045Z","modified":"2026-03-05T15:42:05.041Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-177"],"updated_at":"2026-11-02T14:19:56.284359Z"}],"euvd":[{"id":"EUVD-2026-9506","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path. This issue has been patched in version 4.12.4.","status":"published","published":"2026-03-04T22:09:22Z","modified":"2026-03-05T15:42:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T19:48:08.87511Z"}],"ghsa":[{"id":"GHSA-q5qw-h33p-qvwr","title":"Hono vulnerable to arbitrary file access via serveStatic vulnerability ","description":"## Summary\n\nWhen using `serveStatic` together with route-based middleware protections (e.g. `app.use('/admin/*', ...)`), inconsistent URL decoding allowed protected static resources to be accessed without authorization.\n\nThe router used `decodeURI`, while `serveStatic` used `decodeURIComponent`. This mismatch allowed paths containing encoded slashes (`%2F`) to bypass middleware protections while still resolving to the intended filesystem path.\n\n\n## Details\n\nThe routing layer preserved `%2F` as a literal string, while `serveStatic` decoded it into `/` before resolving the file path.\n\nExample:\n\nRequest: `/admin%2Fsecret.html`\n\n- Router sees: `/admin%2Fsecret.html` → does not match `/admin/*`\n- Static handler resolves: `/admin/secret.html`\n\nAs a result, static files under the configured static root could be served without triggering route-based protections.\n\nThis only affects applications that both:\n\n- Protect subpaths using route-based middleware, and\n- Serve files from the same static root using `serveStatic`.\n\nThis does **not** allow access outside the static root and is **not** a path traversal vulnerability.\n\n\n## Impact\n\nAn unauthenticated attacker could bypass route-based authorization for protected static resources by supplying paths containing encoded slashes.\n\nApplications relying solely on route-based middleware to protect static subpaths may have exposed those resources.","status":"published","published":"2026-03-04T19:48:00Z","modified":"2026-03-05T15:26:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-177"],"updated_at":"2026-11-02T14:39:31.060223Z"}],"nvd":[{"id":"CVE-2026-29045","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path. This issue has been patched in version 4.12.4.","status":"published","published":"2026-03-04T23:16:10.247Z","modified":"2026-06-17T10:29:30.013Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-177"],"updated_at":"2026-11-02T14:12:07.852448Z"}],"osv":[{"id":"CVE-2026-29045","title":"Hono: Arbitrary file access via serveStatic vulnerability","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path. This issue has been patched in version 4.12.4.","status":"published","published":"2026-03-04T22:09:22.045Z","modified":"2026-10-28T02:31:00.237962727Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-177"],"updated_at":"2026-11-02T15:45:00.530889Z"},{"id":"GHSA-q5qw-h33p-qvwr","title":"Hono vulnerable to arbitrary file access via serveStatic vulnerability ","description":"## Summary\n\nWhen using `serveStatic` together with route-based middleware protections (e.g. `app.use('/admin/*', ...)`), inconsistent URL decoding allowed protected static resources to be accessed without authorization.\n\nThe router used `decodeURI`, while `serveStatic` used `decodeURIComponent`. This mismatch allowed paths containing encoded slashes (`%2F`) to bypass middleware protections while still resolving to the intended filesystem path.\n\n\n## Details\n\nThe routing layer preserved `%2F` as a literal string, while `serveStatic` decoded it into `/` before resolving the file path.\n\nExample:\n\nRequest: `/admin%2Fsecret.html`\n\n- Router sees: `/admin%2Fsecret.html` → does not match `/admin/*`\n- Static handler resolves: `/admin/secret.html`\n\nAs a result, static files under the configured static root could be served without triggering route-based protections.\n\nThis only affects applications that both:\n\n- Protect subpaths using route-based middleware, and\n- Serve files from the same static root using `serveStatic`.\n\nThis does **not** allow access outside the static root and is **not** a path traversal vulnerability.\n\n\n## Impact\n\nAn unauthenticated attacker could bypass route-based authorization for protected static resources by supplying paths containing encoded slashes.\n\nApplications relying solely on route-based middleware to protect static subpaths may have exposed those resources.","status":"published","published":"2026-03-04T19:48:00Z","modified":"2026-09-10T03:50:40.471950564Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-177"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"CLSA-2026-1792232996","title":"TuxCare security update for hono (2 CVEs)","description":"TuxCare rebuilt hono to address 2 CVEs. Fixed in 3.12.12-tuxcare.4.","status":"published","published":"2026-10-17T10:29:56Z","modified":"2026-10-17T13:09:28.769429375Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"ROOT-APP-NPM-CVE-2026-29045","title":"CVE-2026-29045 in @rootio/hono - Patched by Root","description":"Root has patched CVE-2026-29045 in the @rootio/hono package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-09T12:47:49Z","modified":"2026-06-09T19:30:08.93624076Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}