Flaw in Hono Framework's Path Encoding and Static File Protection

CVE-2026-111757

What is CVE-2026-111757?

The Hono Framework, from versions 4.12.4 to 4.13.11, contains a path encoding vulnerability within its serveStatic component. This flaw allows an attacker to exploit malformed percent-encoded paths, bypassing protections enforced by upstream routing middleware. The root cause originates from a second decoding of routed request paths during filesystem lookup, leading to potential unauthorized disclosure of static files that should have been protected. The issue is mitigated in version 4.13.11, which resolves the misinterpretation of encoded paths and strengthens the framework's security against such attacks.

References