Middleware Bypass in Hono Framework by HonoJS

CVE-2026-109955

What is CVE-2026-109955?

The Hono Framework versions prior to 4.13.11 are susceptible to a middleware bypass vulnerability within the serveStatic function. This flaw permits unauthenticated attackers to exploit double path decoding, enabling them to bypass prefix middleware protections. By sending crafted percent-encoded paths, attackers can access restricted static files without undergoing necessary authentication processes, potentially exposing sensitive information to unauthorized users.

References