CVE-2026-29045
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path. This issue has been patched in version 4.12.4.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS probability
- 0.50%
- CWE
- CWE-177
- Published
- 2026-03-04
- Last modified
- 2026-03-12
Affected products
- honojs hono
Weakness type
Related vulnerabilities
- CVE-2026-76172 — fast-uri vulnerable to host confusion via percent-encoded scheme normalization
- CVE-2026-67448 — Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)
- CVE-2026-15371 — Velociraptor Stored XSS in URL column types
- CVE-2026-59083 — Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass
- CVE-2026-41041 — Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.
- CVE-2026-6414 — @fastify/static vulnerable to route guard bypass via encoded path separators
- CVE-2026-22037 — @fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)
- CVE-2026-22031 — Fastify Middie Middleware Path Bypass