critique
CVE-2026-29045
Hono vulnerable to arbitrary file access via serveStatic vulnerability
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon GHSA (élevée).
Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path. This issue has been patched in version 4.12.4.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| chainguard | hono, kibana-9.1, librechat et 2 autres | 0 et 4 autres |
| minimos | mcp-filesystem, openclaw, opensearch-dashboards-2 et 2 autres | 2026.6.16-r0 et 3 autres |
| npm::GitHub Security Advisory npm | hono | 4.12.4 |
Afficher les 11 entrées de 3 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| chainguard | hono | 0 |
| chainguard | kibana-9.1 | 9.1.10-r7 |
| chainguard | librechat | 0.8.3-r1 |
| chainguard | opensearch-dashboards-2 | 2.19.5-r3 |
| chainguard | opensearch-dashboards-2-fips | 2.19.5-r1 |
| minimos | mcp-filesystem | 2026.6.16-r0 |
| minimos | openclaw | 2026.3.7-r0 |
| minimos | opensearch-dashboards-2 | 2.19.6-r0 |
| minimos | opensearch-dashboards-fips-2 | 2.19.6-r0 |
| minimos | trigger-dev | 4.5.4-r0 |
| npm::GitHub Security Advisory npm | hono | 4.12.4 |