critical
CVE-2026-29045
Hono vulnerable to arbitrary file access via serveStatic vulnerability
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by GHSA (high).
Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path. This issue has been patched in version 4.12.4.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| chainguard | hono, kibana-9.1, librechat and 2 more | 0 and 4 more |
| minimos | mcp-filesystem, openclaw, opensearch-dashboards-2 and 2 more | 2026.6.16-r0 and 3 more |
| npm::GitHub Security Advisory npm | hono | 4.12.4 |
Show all 11 entries from 3 sources
| Source | Package | Fixed in |
|---|---|---|
| chainguard | hono | 0 |
| chainguard | kibana-9.1 | 9.1.10-r7 |
| chainguard | librechat | 0.8.3-r1 |
| chainguard | opensearch-dashboards-2 | 2.19.5-r3 |
| chainguard | opensearch-dashboards-2-fips | 2.19.5-r1 |
| minimos | mcp-filesystem | 2026.6.16-r0 |
| minimos | openclaw | 2026.3.7-r0 |
| minimos | opensearch-dashboards-2 | 2.19.6-r0 |
| minimos | opensearch-dashboards-fips-2 | 2.19.6-r0 |
| minimos | trigger-dev | 4.5.4-r0 |
| npm::GitHub Security Advisory npm | hono | 4.12.4 |