Read the docs
TI-2026-76534 Aliases CVE-2026-111757GHSA-5r4p-p66f-jhc7

Double decoding in Hono serveStatic bypasses static prefix protection

Priority LOW 30CWE-174Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 1 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Hono from 4.12.4 before 4.13.11 is affected. The serveStatic function decodes an already routed request path a second time, a double decoding flaw (CWE-174). A remote unauthenticated attacker can send a malformed percent-encoded path to read a static file that upstream middleware was meant to protect. The issue does not allow traversal outside the configured static root.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding survives the first routing interpretation and becomes a protected path only during the later static-file decode. The affected component is serveStatic. The trigger conditions are an application protects a static prefix with upstream middleware and serveStatic receives an attacker-controlled malformed percent-encoded path. The impact is unauthorized disclosure of a static file that upstream middleware was intended to protect. The issue does not permit traversal outside the configured static root. This issue is fixed in version 4.13.11.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0031 24th percentileScored 2026-11-07
Fix Partial hono (honojs): 4.13.11hono (npm): 4.13.11Red Hat: 3 advisoriesRed Hat: 1 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
honojshono4.12.4 to before 4.13.114.13.11Patch availableCNA
—hono (npm)4.12.4 to before 4.13.114.13.11Patch availableGHSA-5r4p-p66f-jhc7
  • hono Vendorhonojs Affected 4.12.4 to before 4.13.11 Fixed in 4.13.11 Patch available CNA
  • hono (npm) Vendor— Affected 4.12.4 to before 4.13.11 Fixed in 4.13.11 Patch available GHSA-5r4p-p66f-jhc7

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:hono:hono:*:*:*:*:*:*:*:*——honojs
  • cpe:2.3:a:hono:hono:*:*:*:*:*:*:*:* Versions — — ·honojs

Remediation

Upgrade the npm package hono to version 4.13.11. Red Hat fixes for Red Hat Hardened Images are in RHSA-2026:85544, RHSA-2026:85295 and RHSA-2026:84423. Red Hat lists no available plan for Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat OpenShift AI (RHOAI) and Red Hat OpenShift Dev Spaces.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA hono (honojs) Fixed in 4.13.11
  • Fix · GHSA-5r4p-p66f-jhc7 hono (npm) Fixed in 4.13.11 Advisory →

Red Hat 3 advisories

  • RHSA-2026:85544 Released 2026-10-19 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images grafana13.2-13.2.4-0.1.hum1@aarch64, grafana13.2-13.2.4-0.1.hum1@s390x, grafana13.2-13.2.4-0.1.hum1@src +1
  • RHSA-2026:85295 Released 2026-10-19 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images grafana12.4-12.4.13-0.1.hum1@aarch64, grafana12.4-12.4.13-0.1.hum1@src, grafana12.4-12.4.13-0.1.hum1@x86_64
  • RHSA-2026:84423 Released 2026-10-17 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.1-13.1.7-0.2.hum1@aarch64, grafana13.1-13.1.7-0.2.hum1@s390x, grafana13.1-13.1.7-0.2.hum1@src +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 2AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred
Red Hat OpenShift Dev SpacesAffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:84423, RHSA-2026:85295, RHSA-2026:85544

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-111757
  2. 2026-10-20 Affected versions changed · Red Hat
  3. 2026-10-20 CVSS score added · Red Hat
  4. 2026-10-20 Alias added: GHSA-5r4p-p66f-jhc7
  5. 2026-10-20 Fix available: npm/[email protected] · GHSA-5r4p-p66f-jhc7
  6. 2026-10-20 CVSS score added · GHSA-5r4p-p66f-jhc7
  7. 2026-10-20 Weakness changed · GHSA-5r4p-p66f-jhc7
  8. 2026-10-20 5 new references · GHSA-5r4p-p66f-jhc7
  9. 2026-10-20 CISA SSVC decision points changed
  10. 2026-10-21 Fix available: RHSA-2026:85544 · Red Hat
  11. 2026-10-21 Fix available: RHSA-2026:84423 · Red Hat
  12. 2026-10-21 Fix available: RHSA-2026:85295 · Red Hat
  13. 2026-10-21 Fix available: Red Hat Hardened Images · Red Hat

References

Advisory 1

Other 4

  • TI-2024-21741 Hono vulnerable to Restricted Directory Traversal in serveStatic with deno CVSS 3.1MEDIUM 5.3
  • TI-2024-15441 @hono/node-server can't handle "double dots" in URL CVSS 3.1MEDIUM 5.3
  • TI-2024-32610 Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header. CVSS 3.1MEDIUM 5.9
  • TI-2024-29381 Hono CSRF middleware can be bypassed using crafted Content-Type header CVSS 3.1MEDIUM 5.0
  • TI-2026-39189 Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest CVSS 3.1MEDIUM 4.8
  • TI-2026-23190 Hono: Arbitrary file access via serveStatic vulnerability CVSS 3.1CRITICAL 9.8
See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences