PT-2026-31281 · Hono · Hono

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-39407

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.12

Description A path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. For example, a request like GET //admin/secret.txt can bypass middleware registered on /admin/* and access protected files. The routing layer and serveStatic handle repeated slashes differently.

Recommendations Update to version 4.12.12 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-39407

GHSA-WMMM-F939-6G9C

Affected Products

Hono

References · 10

• https://github.com/honojs/hono/security/advisories/GHSA-wmmm-f939-6g9c · Vendor Advisory
• https://github.com/honojs/hono/commit/9aff14bd727f8b0435c963363fd803260e7b8e3c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-39407 · Security Note
• https://osv.dev/vulnerability/GHSA-wmmm-f939-6g9c · Vendor Advisory
• https://github.com/honojs/hono · Note
• https://github.com/honojs/hono/releases/tag/v4.12.12 · Note
• https://twitter.com/infoflowcloud/status/2041977459420107194 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2041916625281061307 · Twitter Post
• https://twitter.com/CVEnew/status/2041975648093106483 · Twitter Post
• https://t.me/CVEtracker/50067 · Telegram Post