7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29045

CVE-2026-29045: Hono: Arbitrary file access via serveStatic vulnerability

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path. This issue has been patched in version 4.12.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29045

CVE-2026-29045:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hono	npm	< 4.12.4	4.12.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is caused by an inconsistent URL decoding between Hono's router and the serveStatic middleware. The router uses a decoding method that preserves encoded slashes (%2F), while the serveStatic middleware was using decodeURIComponent, which decodes %2F into a literal slash (/). This allowed an attacker to bypass authorization middleware attached to a route prefix like /admin/*. A request to /admin%2Fprotected.file would not match the router's rule, skipping the authorization check. However, the serveStatic handler would then decode the path to /admin/protected.file and serve the resource, leading to an authorization bypass. The analysis of the patch commit 6a0607a929d888893f0c91d92dce2fcfdb3662a3 confirms that the serveStatic function in src/middleware/serve-static/index.ts is the source of the vulnerability, as the fix involves replacing decodeURIComponent with tryDecodeURI to align its behavior with the router.

Vulnerable functions

serveStatic

src/middleware/serve-static/index.ts

The `serveStatic` function used `decodeURIComponent` to process the request path. This function decodes encoded slashes (`%2F`), while Hono's router does not. This discrepancy allowed an attacker to craft a URL with an encoded slash (e.g., `/admin%2Fsecret.txt`) to bypass route-based middleware (e.g., `/admin/*`) and access protected static files, as `serveStatic` would resolve the path to `admin/secret.txt` after decoding.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.