kritik
CVE-2026-29045
Hono vulnerable to arbitrary file access via serveStatic vulnerability
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: GHSA (yüksek).
Açıklama
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path. This issue has been patched in version 4.12.4.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| chainguard | hono, kibana-9.1, librechat ve 2 tane daha | 0 ve 4 tane daha |
| minimos | mcp-filesystem, openclaw, opensearch-dashboards-2 ve 2 tane daha | 2026.6.16-r0 ve 3 tane daha |
| npm::GitHub Security Advisory npm | hono | 4.12.4 |
3 kaynaktaki 11 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| chainguard | hono | 0 |
| chainguard | kibana-9.1 | 9.1.10-r7 |
| chainguard | librechat | 0.8.3-r1 |
| chainguard | opensearch-dashboards-2 | 2.19.5-r3 |
| chainguard | opensearch-dashboards-2-fips | 2.19.5-r1 |
| minimos | mcp-filesystem | 2026.6.16-r0 |
| minimos | openclaw | 2026.3.7-r0 |
| minimos | opensearch-dashboards-2 | 2.19.6-r0 |
| minimos | opensearch-dashboards-fips-2 | 2.19.6-r0 |
| minimos | trigger-dev | 4.5.4-r0 |
| npm::GitHub Security Advisory npm | hono | 4.12.4 |