Hono EUVD-2026-104537

Exploitation requires a specific, non-default deployment: the application must (1) run Hono serveStatic in an affected version (4.12.4 through 4.13.10), and (2) protect a static sub-prefix with upstream routing/authorization middleware (e.g. app.use('/static/admin/*', authMiddleware) in front of serveStatic on '/static/*'). The attacker then supplies an attacker-controlled malformed percent-encoded path (such as '/static/%%36%31dmin/secret.txt') that survives the first routing-layer interpretation but resolves to the protected path during serveStatic's second filesystem-lookup decode. Limiting factors that reduce real-world risk: the flaw yields only disclosure of files already inside the configured static root (no path traversal outside it, no write/integrity/availability impact); applications that do not place access-control middleware on a sub-prefix of the static root are unaffected; and it is a read-only confidentiality issue, not code execution.

This is a moderate, conditional information-disclosure flaw rather than a critical issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3) indicates remote, unauthenticated, low-complexity reachability, but impact is deliberately limited: Confidentiality is Low with no Integrity or Availability effect, and the advisory explicitly states the bug does NOT allow traversal outside the configured static root - only disclosure of a single static file that upstream middleware was meant to protect. The 'network/unauthenticated/low-complexity' signals must be read against a hard precondition: the target application must both use Hono serveStatic AND protect a static sub-prefix with upstream routing middleware, so the real-world exploitable population is a subset of Hono deployments, not all of them. No EPSS score and no CISA KEV entry were provided in the input, so exploitation probability cannot be quantified; exploitation status is 'no public exploit identified at time of analysis.' However, the public fix commit (8b05c774) ships regression tests containing the exact working bypass payload (e.g. '/static/%%36%31dmin/secret.txt' double-decoding to 'admin'), so a working exploit primitive is effectively public even though no standalone weaponized tool is cited. Net: a legitimate patch-management priority for teams running the affected Hono versions behind prefix-based access control, but not an emergency mass-exploitation scenario given the Low confidentiality-only impact and configuration dependency.

An application serves static files via Hono serveStatic and guards a sensitive sub-prefix (e.g. '/static/admin/*') with upstream authentication/authorization middleware. A remote unauthenticated attacker requests a malformed percent-encoded path such as '/static/%%36%31dmin/secret.txt', which the routing layer does not recognize as the protected '/static/admin/...' route, so it passes through to serveStatic, which decodes a second time and reads the protected file. The exact bypass payload is publicly demonstrated in the fix commit's regression tests, making reproduction straightforward.