Is CVE-2026-111757 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111757 being exploited in the wild.

How severe is CVE-2026-111757?

Medium severity, with a CVSS score of 5.3, published 19 October 2026.

Which products and versions are affected?

Hono 4.12.4 to 4.13.10; hono (npm) >= 4.12.4, < 4.13.11.

How is CVE-2026-111757 attacked?

It is attacked over the network.

Am I affected by CVE-2026-111757?

Check whether you run Hono or hono (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111757: Hono serveStatic authorization bypass via double percent-decoding

Q: Is there a fix for CVE-2026-111757?

Yes: fixed in 4.13.11. Until then: Set allowPercentInPath option to explicitly enable percent signs in paths only when necessary; reject routed requests containing percent signs before additional decoding to prevent bypass. [{"kind": "disclosed", "at": "2026-09-29"}, {"kind": "patched", "at": "2026-10-19", "note": "Version 4.13.11 released"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-111757 · Severity: medium · CVSS 5.3 · Published 2026-10-19

Hono is a web application framework that serves static files and routes web requests. The serveStatic component decodes file paths twice, allowing attackers to bypass middleware protections (such as authentication checks) on static files by crafting malformed percent-encoded URLs. An attacker can access protected files without the intended access controls being enforced.

Technologies: Hono, hono (npm). Vendors: Hono, npm.

Quick answers

Is CVE-2026-111757 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111757 being exploited in the wild.
How severe is CVE-2026-111757?: Medium severity, with a CVSS score of 5.3, published 19 October 2026.
Which products and versions are affected?: Hono 4.12.4 to 4.13.10; hono (npm) >= 4.12.4, < 4.13.11.
Is there a fix for CVE-2026-111757?: Yes: fixed in 4.13.11. Until then: Set allowPercentInPath option to explicitly enable percent signs in paths only when necessary; reject routed requests containing percent signs before additional decoding to prevent bypass.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-29"}, {"kind": "patched", "at": "2026-10-19", "note": "Version 4.13.11 released"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111757 attacked?: It is attacked over the network.
Am I affected by CVE-2026-111757?: Check whether you run Hono or hono (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.13.11

Set allowPercentInPath option to explicitly enable percent signs in paths only when necessary; reject routed requests containing percent signs before additional decoding to prevent bypass.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-29"}, {"kind": "patched", "at": "2026-10-19", "note": "Version 4.13.11 released"}]

Technical details

The vulnerability is a double-decoding authorization bypass in the serveStatic middleware (CWE-174). Hono decodes the request path once during routing, then serveStatic decodes it again before filesystem lookup. A malformed percent-encoded sequence survives the first decode in an encoded state, matching routing rules, but then resolves to a different path during the second decode in serveStatic. This allows bypassing upstream middleware mounted on a static prefix. The attack requires network access and no authentication; file access is limited to the configured static root.

Affected products

Hono Hono 4.12.4 to 4.13.10

Identifiers

CVE-2026-111757
GHSA-5r4p-p66f-jhc7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.