CVE-2026-39407
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
In Hono prior to version 4.12.12, a path handling inconsistency in serveStatic allows access to protected static files by using repeated slashes (//) in the request path. This can lead to a bypass of route-based authorization.
Risk Assessment
The organization is at risk of unauthorized access to protected static files, potentially leading to exposure of sensitive data.
Recommendation
Update Hono to version 4.12.12 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in 4.12.12.