{"id":"CVE-2026-29045","published":"2026-03-04T22:09:22Z","modified":"2026-03-05T15:42:05Z","title":"Hono: Arbitrary file access via serveStatic vulnerability","vendor":"honojs","product":"hono","tier":"tail","description":{"text":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path. This issue has been patched in version 4.12.4.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00587,"percentile":0.48107,"provenance":"source"},"cwes":[{"id":"CWE-177","name":"Improper Handling of URL Encoding (Hex Encoding)"}],"references":[{"url":"https://github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/honojs/hono/commit/6a0607a929d888893f0c91d92dce2fcfdb3662a3","tags":["x_refsource_MISC"]}],"priority":{"score":14.9,"factors":[{"name":"EPSS percentile","points":9.62},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"honojs","affectedVersions":[{"vendor":"honojs","product":"hono","versions":["< 4.12.4"]}],"affected":[{"ecosystem":"npm","package":"hono","vulnerableRanges":["<4.12.4"],"patched":["4.12.4"],"from":["GHSA-q5qw-h33p-qvwr"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-9506","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-fastify-static-cve-2026-22031","children":[{"from":"CVE-2026-29045","to":"CVE-2026-6414","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-q5qw-h33p-qvwr","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-x428-ghpx-8j92","via":"reference","url":"https://github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr"}]}],"packageHistory":[{"cve":"CVE-2026-24473","published":"2026-01-27","fixed":"4.11.7","kev":false},{"cve":"CVE-2026-24771","published":"2026-01-27","fixed":"4.11.7","kev":false},{"cve":"CVE-2026-27700","published":"2026-02-25","fixed":"4.12.2","kev":false,"link":{"from":"CVE-2026-27700","to":"CVE-2026-29045","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:hono","fromFixed":"4.12.2","toFixed":"4.12.4","daysApart":7}]}},{"cve":"CVE-2026-29045","published":"2026-03-04","fixed":"4.12.4","kev":false},{"cve":"CVE-2026-29085","published":"2026-03-04","fixed":"4.12.4","kev":false},{"cve":"CVE-2026-29086","published":"2026-03-04","fixed":"4.12.4","kev":false},{"cve":"CVE-2026-56763","published":"2026-07-11","fixed":"4.12.7","kev":false,"link":{"from":"CVE-2026-29045","to":"CVE-2026-56763","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:hono","fromFixed":"4.12.4","toFixed":"4.12.7","daysApart":129}]}}],"package":"npm:hono"}}