Read the docs
TI-2026-71722 Aliases CVE-2026-109955GHSA-3g9q-qwv8-cxpf

Middleware bypass in Hono serveStatic via double path decoding

Priority LOW 36CWE-174Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 1 fixed, 5 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Hono from 4.12.4 before 4.13.11 contains a middleware bypass in serveStatic. The router matches malformed percent-encoded paths in encoded form, so the path is decoded twice (CWE-174) and requests reach static files before prefix middleware runs. An unauthenticated remote attacker can send such paths to reach static files without authentication checks running.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths that the router matches in encoded form, reaching static files without authentication checks running.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00315 24th percentileScored 2026-11-07
Fix Partial hono (honojs): 4.13.11Red Hat: 3 advisoriesRed Hat: 1 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
honojshono4.12.4 to before 4.13.114.13.11Patch availableCNA
  • hono Vendorhonojs Affected 4.12.4 to before 4.13.11 Fixed in 4.13.11 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:hono:hono:*:*:*:*:*:*:*:*——honojs
  • cpe:2.3:a:hono:hono:*:*:*:*:*:*:*:* Versions — — ·honojs

Remediation

Update hono to 4.13.11. Red Hat fixes Red Hat Hardened Images in RHSA-2026:84431, RHSA-2026:84423 and RHSA-2026:84422. Red Hat lists no available plan for Migration Toolkit for Applications 8, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat OpenShift AI (RHOAI) and Red Hat OpenShift Dev Spaces.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA hono (honojs) Fixed in 4.13.11

Red Hat 3 advisories

  • RHSA-2026:84431 Released 2026-10-17 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.2-13.2.3-0.2.hum1@aarch64, grafana13.2-13.2.3-0.2.hum1@s390x, grafana13.2-13.2.3-0.2.hum1@src +1
  • RHSA-2026:84423 Released 2026-10-17 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.1-13.1.7-0.2.hum1@aarch64, grafana13.1-13.1.7-0.2.hum1@s390x, grafana13.1-13.1.7-0.2.hum1@src +1
  • RHSA-2026:84422 Released 2026-10-17 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana12.4-12.4.12-0.5.hum1@aarch64, grafana12.4-12.4.12-0.5.hum1@src, grafana12.4-12.4.12-0.5.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for Applications 8AffectedNo fix yet: Fix deferred
Red Hat Ansible Automation Platform 2AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred
Red Hat OpenShift Dev SpacesAffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:84422, RHSA-2026:84423, RHSA-2026:84431

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-109955
  2. 2026-10-13 Alias added: GHSA-3g9q-qwv8-cxpf
  3. 2026-10-15 Affected versions changed · Red Hat
  4. 2026-10-15 CVSS score added · Red Hat
  5. 2026-10-18 Fix available: RHSA-2026:84423 · Red Hat
  6. 2026-10-18 Fix available: RHSA-2026:84422 · Red Hat
  7. 2026-10-18 Fix available: RHSA-2026:84431 · Red Hat
  8. 2026-10-18 Fix available: Red Hat Hardened Images · Red Hat

References

Advisory 1

  • TI-2024-21741 Hono vulnerable to Restricted Directory Traversal in serveStatic with deno CVSS 3.1MEDIUM 5.3
  • TI-2024-15441 @hono/node-server can't handle "double dots" in URL CVSS 3.1MEDIUM 5.3
  • TI-2024-32610 Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header. CVSS 3.1MEDIUM 5.9
  • TI-2024-29381 Hono CSRF middleware can be bypassed using crafted Content-Type header CVSS 3.1MEDIUM 5.0
  • TI-2026-39189 Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest CVSS 3.1MEDIUM 4.8
  • TI-2026-23190 Hono: Arbitrary file access via serveStatic vulnerability CVSS 3.1CRITICAL 9.8
See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences