CVE-2026-111757

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding survives the first routing interpretation and becomes a protected path only during the later static-file decode. The affected component is serveStatic. The trigger conditions are an application protects a static prefix with upstream middleware and serveStatic receives an attacker-controlled malformed percent-encoded path. The impact is unauthorized disclosure of a static file that upstream middleware was intended to protect. The issue does not permit traversal outside the configured static root. This issue is fixed in version 4.13.11.

• CWE-174

• https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc
• https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7
• https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7
• https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7
• https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7

Published

Oct 19, 2026

Last Modified

Oct 20, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-111748AIOHTTP is an asynchronous HTTP client/server framework for …6.3
• CVE-2026-111749AIOHTTP is an asynchronous HTTP client/server framework for …2.3
• CVE-2026-11175Incorrect security UI in Messages in Google Chrome on Androi…8.8
• CVE-2026-111750AIOHTTP is an asynchronous HTTP client/server framework for …6.3
• CVE-2026-111755follow-redirects is a Node.js HTTP and HTTPS client wrapper …8.2
• CVE-2026-111756follow-redirects is a Node.js HTTP and HTTPS client wrapper …8.2
• CVE-2026-111758markdown-it is a Markdown parser. From versions 14.1.0 to be…7.5
• CVE-2026-111759markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2…7.5
• CVE-2026-11176Inappropriate implementation in Media in Google Chrome prior…6.5
• CVE-2026-111761A2A Java SDK is the official Java SDK for the Agent2Agent (A…5.8
• CVE-2026-111762A2A Java SDK is the official Java SDK for the Agent2Agent (A…5.7
• CVE-2026-111763A2A Java SDK is the official Java SDK for the Agent2Agent (A…5.7