kritisch
CVE-2026-29045
Hono vulnerable to arbitrary file access via serveStatic vulnerability
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut GHSA (hoch).
Beschreibung
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path. This issue has been patched in version 4.12.4.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| chainguard | hono, kibana-9.1, librechat und 2 weitere | 0 und 4 weitere |
| minimos | mcp-filesystem, openclaw, opensearch-dashboards-2 und 2 weitere | 2026.6.16-r0 und 3 weitere |
| npm::GitHub Security Advisory npm | hono | 4.12.4 |
Alle 11 Einträge aus 3 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| chainguard | hono | 0 |
| chainguard | kibana-9.1 | 9.1.10-r7 |
| chainguard | librechat | 0.8.3-r1 |
| chainguard | opensearch-dashboards-2 | 2.19.5-r3 |
| chainguard | opensearch-dashboards-2-fips | 2.19.5-r1 |
| minimos | mcp-filesystem | 2026.6.16-r0 |
| minimos | openclaw | 2026.3.7-r0 |
| minimos | opensearch-dashboards-2 | 2.19.6-r0 |
| minimos | opensearch-dashboards-fips-2 | 2.19.6-r0 |
| minimos | trigger-dev | 4.5.4-r0 |
| npm::GitHub Security Advisory npm | hono | 4.12.4 |