Junglewise Threat Intelligence

CVE-2026-39407: Hono auth bypass via repeated slashes in serveStatic

CVE-2026-39407 · Severity: medium · CVSS 5.3 · Published 2026-04-08

Technologies: Honojs Hono. Vendors: npm.

Executive brief

Hono is a web application framework used to build and run JavaScript-based websites and services. A security flaw in how the framework handles web addresses allows attackers to bypass security rules and access private files. By using extra slashes in a URL (such as //admin/file), an attacker can trick the system into skipping authorization checks, potentially exposing sensitive internal documents or configuration files.

Technical details

A path handling inconsistency exists in Hono's 'serveStatic' middleware. The vulnerability arises because the routing layer and the static file server handle repeated slashes (e.g., '//') differently. While route-based middleware (such as an authorization check on '/admin/*') may fail to match a path containing double slashes, the 'serveStatic' component normalizes the path and serves the underlying file. A remote, unauthenticated attacker can exploit this by crafting requests with repeated slashes to bypass security middleware and access restricted static files. This issue is classified as a Path Traversal/Middleware Bypass and is resolved in version 4.12.12 by prohibiting consecutive slashes in paths.

Affected products

  • honojs Hono < 4.12.12

Timeline

  • 2026-04-07: patched: Version 4.12.12 released
  • 2026-04-08: disclosed: NVD publication date

References

Related threats