Path Handling Inconsistency in Hono Web Application Framework

CVE-2026-39407

What is CVE-2026-39407?

Hono, a versatile web application framework supporting various JavaScript runtimes, is affected by a path handling inconsistency prior to version 4.12.12. This issue allows unauthorized access to protected static files. When requests contain repeated slashes (//), the route-based middleware may not correctly authorize these requests, resulting in a potential middleware bypass. This discrepancy occurs because the serveStatic method normalizes paths differently, leading to security risks. Users are advised to update to version 4.12.12 or later to mitigate this vulnerability.

References