Executive brief
Hono is a web application framework used to build and run JavaScript-based websites and services. A security flaw in how the framework handles web addresses allows attackers to bypass security rules and access private files. By using extra slashes in a URL (such as //admin/file), an attacker can trick the system into skipping authorization checks, potentially exposing sensitive internal documents or configuration files.
Technical details
A path handling inconsistency exists in Hono's 'serveStatic' middleware. The vulnerability arises because the routing layer and the static file server handle repeated slashes (e.g., '//') differently. While route-based middleware (such as an authorization check on '/admin/*') may fail to match a path containing double slashes, the 'serveStatic' component normalizes the path and serves the underlying file. A remote, unauthenticated attacker can exploit this by crafting requests with repeated slashes to bypass security middleware and access restricted static files. This issue is classified as a Path Traversal/Middleware Bypass and is resolved in version 4.12.12 by prohibiting consecutive slashes in paths.
Affected products
- honojs Hono < 4.12.12
Timeline
- 2026-04-07: patched: Version 4.12.12 released
- 2026-04-08: disclosed: NVD publication date