Executive brief
Hono is a web application framework used to build and run JavaScript-based websites and services. A security flaw in how it handles file requests on Windows systems allows unauthorized users to bypass security filters and access private files. This could lead to the exposure of sensitive internal documents or configuration files that were intended to be protected.
Technical details
A path traversal vulnerability exists in Hono's 'serve-static' component when running on Windows hosts. The framework's router splits paths based on forward slashes (/), but fails to account for encoded backslashes (%5C) which the Windows path resolver treats as a directory separator. An attacker can craft a request like '/admin%5Csecret.txt' which the router treats as a single segment, bypassing middleware mounted on '/admin/*'. The 'serve-static' guard subsequently allows the backslash through to the file system, enabling unauthenticated access to files within the root directory that should be protected. This issue affects Node, Bun, and Deno adapters on Windows and is resolved in version 4.12.25.
Affected products
- honojs Hono < 4.12.25
Timeline
- 2026-06-09: advisory: GitHub advisory published by yusukebe
- 2026-06-22: disclosed: NVD publication date