CVE-2026-111757 Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
Attackers can bypass middleware protections to read unauthorized static files in Hono applications using malformed percent-encoded paths.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-111757?
CVE-2026-111757 is a medium-severity path traversal vulnerability in honojs hono, published on 19 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding survives the first routing interpretation and becomes a protected path only during the later static-file decode. The affected component is serveStatic. The trigger conditions are an application protects a static prefix with upstream middleware and serveStatic receives an attacker-controlled malformed percent-encoded path. The impact is unauthorized disclosure of a static file that upstream middleware was intended to protect. The issue does not permit traversal outside the configured static root. This issue is fixed in version 4.13.11.
Weakness: CWE-174
Which versions are affected by CVE-2026-111757?
How do I fix CVE-2026-111757?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-111757 being exploited?
There is no known exploitation of CVE-2026-111757 in the wild and no public exploit code.
Sources
Also known as ECHO-693e-a60e-a833, MINI-wjxm-889f-3j4g.