CVE-2026-109955: Hono serveStatic Auth Bypass Vulnerability

CVE-2026-109955 Overview

CVE-2026-109955 is a middleware bypass vulnerability in the Hono web framework, affecting versions from 4.12.4 before 4.13.11. The flaw resides in the serveStatic middleware, where double path decoding allows unauthenticated attackers to skip prefix middleware checks. Attackers send malformed percent-encoded paths that the router matches in encoded form, reaching static files before authentication middleware executes. The vulnerability is classified under CWE-174: Double Decoding of the Same Data.

Critical Impact

Unauthenticated attackers can bypass authentication and authorization middleware to access static files intended to be protected by prefix-based access controls.

Affected Products

• Hono framework versions 4.12.4 through 4.13.10
• Applications using serveStatic middleware with prefix-based authentication
• Node.js, Bun, Deno, and edge runtime deployments using vulnerable Hono versions

Discovery Timeline

• 2026-10-13 - CVE-2026-109955 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109955

Vulnerability Analysis

The vulnerability arises from inconsistent path handling between Hono's router and its serveStatic middleware. When a request arrives with percent-encoded characters, the router performs matching against the encoded form of the path. The serveStatic middleware then decodes the path a second time when resolving the file on disk.

This mismatch creates a bypass window. A route protected by prefix middleware, such as authentication guarding /admin/*, matches only the literal encoded prefix. Attackers craft requests that encode the prefix characters so the router does not match the protected prefix, yet serveStatic still resolves the request to a file inside that protected directory.

The outcome is unauthenticated retrieval of files that application developers assumed were gated by middleware. Because Hono runs across multiple JavaScript runtimes, the issue impacts server, serverless, and edge deployments equally.

Root Cause

The root cause is double decoding of the same request path at two different layers of the request pipeline. The router uses one representation for middleware matching while serveStatic uses a different, further-decoded representation for file resolution. Trust boundaries are crossed because middleware authorization decisions are made against a path that no longer represents the resource ultimately served.

Attack Vector

Exploitation requires only network access to the vulnerable application. No authentication, user interaction, or elevated privileges are needed. An attacker issues an HTTP request with a malformed percent-encoded path targeting a static asset located behind prefix middleware. The request bypasses middleware matching and returns the file contents directly. See the GitHub Security Advisory GHSA-5r4p-p66f-jhc7 and the VulnCheck Advisory for Hono Middleware Bypass for the full technical write-up.

Detection Methods for CVE-2026-109955

Indicators of Compromise

• HTTP requests containing double-encoded or malformed percent-encoded sequences such as %25 variants in paths targeting static asset directories.
• Access log entries showing successful 200 responses to protected static paths without a corresponding authenticated session.
• Requests to static file endpoints that bypass the usual authentication redirect or 401/403 chain.

Detection Strategies

• Inventory running applications and identify Hono versions between 4.12.4 and 4.13.10 through dependency manifests like package.json and lockfiles.
• Compare request paths at the reverse proxy against paths logged by the application to detect decoding mismatches.
• Add a web application firewall rule that normalizes percent-encoding before matching and blocks ambiguous double-encoded sequences.

Monitoring Recommendations

• Enable verbose access logging on applications using serveStatic and alert on anomalous status codes for protected prefixes.
• Track baseline request patterns to static directories and flag spikes in encoded-path requests.
• Forward web server and application logs to a centralized analytics platform for correlation and retention.

How to Mitigate CVE-2026-109955

Immediate Actions Required

• Upgrade Hono to version 4.13.11 or later across all affected applications.
• Audit serveStatic usage to identify static directories currently gated by prefix middleware.
• Review access logs since the introduction of Hono 4.12.4 for suspicious encoded-path requests.

Patch Information

The vendor fix is included in Hono 4.13.11. Update the dependency in package.json and reinstall. Verify the resolved version with npm ls hono or the equivalent command for your package manager. Refer to the GitHub Security Advisory GHSA-5r4p-p66f-jhc7 for release notes.

Workarounds

• Move sensitive files out of directories served by serveStatic until the upgrade is complete.
• Enforce authentication at the reverse proxy or CDN layer rather than relying solely on application middleware.
• Deploy a WAF rule that rejects requests containing double percent-encoding before they reach the application.

# Upgrade Hono to a fixed version
npm install hono@^4.13.11

# Confirm the resolved version
npm ls hono