crítica
CVE-2026-29045
Hono vulnerable to arbitrary file access via serveStatic vulnerability
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (alta).
Descripción
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path. This issue has been patched in version 4.12.4.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| chainguard | hono, kibana-9.1, librechat y 2 más | 0 y 4 más |
| minimos | mcp-filesystem, openclaw, opensearch-dashboards-2 y 2 más | 2026.6.16-r0 y 3 más |
| npm::GitHub Security Advisory npm | hono | 4.12.4 |
Mostrar las 11 entradas de 3 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| chainguard | hono | 0 |
| chainguard | kibana-9.1 | 9.1.10-r7 |
| chainguard | librechat | 0.8.3-r1 |
| chainguard | opensearch-dashboards-2 | 2.19.5-r3 |
| chainguard | opensearch-dashboards-2-fips | 2.19.5-r1 |
| minimos | mcp-filesystem | 2026.6.16-r0 |
| minimos | openclaw | 2026.3.7-r0 |
| minimos | opensearch-dashboards-2 | 2.19.6-r0 |
| minimos | opensearch-dashboards-fips-2 | 2.19.6-r0 |
| minimos | trigger-dev | 4.5.4-r0 |
| npm::GitHub Security Advisory npm | hono | 4.12.4 |