Executive brief
Hono is a popular web framework for building HTTP applications. Due to inconsistent URL decoding between its router and static file handler, attackers can bypass route-based access controls by using encoded slashes in URLs, gaining unauthorized access to protected static files. This could expose confidential documents, configuration files, or other sensitive resources that applications intended to restrict.
Technical details
The vulnerability stems from a mismatch in URL decoding between Hono's routing layer (which uses decodeURI) and its serveStatic handler (which uses decodeURIComponent). When paths containing encoded slashes (%2F) are requested, the router sees the encoded form and does not match route-based middleware protections (e.g., /admin/*), while serveStatic decodes %2F to / and resolves the actual file path. This allows unauthenticated attackers to bypass authorization middleware protecting static subpaths. The vulnerability requires an application to both protect subpaths via route middleware and serve static files from the same root; it does not enable path traversal outside the static directory. The issue is fixed in version 4.12.4 via commit 6a0607a.
Affected products
- Hono Hono < 4.12.4
Timeline
- 2026-03-04: disclosed
- 2026-03-04: patched: Fixed in version 4.12.4