Hono CVE-2026-109955

Exploitation requires an application that serves files via Hono's serveStatic AND relies on prefix-mounted middleware (such as authentication/authorization) to gate access to those files; the bypass works because a malformed/double percent-encoded path is matched by the router in encoded form, so the prefix middleware does not run before the decoded path reaches the static handler. No credentials, user interaction, or non-default framework settings are needed against such deployments (AV:N/AC:L/PR:N/UI:N). Limiting factors: the issue only matters when (a) serveStatic is actually used, (b) access control is implemented as prefix middleware rather than inside the static handler or at a reverse proxy, and (c) the static files behind that prefix are sensitive; deployments without prefix-based protection of static content are not meaningfully exposed. Affected versions are Hono 4.12.4 up to (not including) 4.13.11.

This is a moderate-severity authentication-bypass issue whose signals are largely consistent. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction, which matches the description of sending malformed percent-encoded paths. The 6.9 score is tempered by limited impact: only VC:L (low confidentiality) with no integrity or availability effect, reflecting that the flaw exposes static files behind prefix middleware rather than granting code execution or data tampering. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation probability cannot be quantified; per precision rules this is 'no public exploit identified at time of analysis.' The real-world priority depends heavily on deployment: it is only dangerous where serveStatic is placed behind prefix-mounted authentication/authorization middleware AND those static assets are sensitive. For deployments that do not use prefix middleware to gate static files, impact is minimal. Net: a legitimate but not emergency-grade issue - patch in normal cycles unless you specifically rely on prefix middleware to protect static content. Note the apparent anomaly that CWE-174 (Double Decoding) is the root cause while the effect is classed as Authentication Bypass; both are consistent here (double decoding is the mechanism that defeats the auth prefix match).

An application uses Hono's serveStatic to serve files behind an authentication middleware mounted on a path prefix. An unauthenticated attacker sends an HTTP request with a double/malformed percent-encoded path that the router matches in its still-encoded form, so the prefix-mounted auth middleware never fires, and the decoded path then resolves to a protected static file. No public exploit code was identified at time of analysis, but the attack is low-complexity and requires no credentials.