5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-39407

CVE-2026-39407: Hono has a middleware bypass via repeated slashes in serveStatic

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in 4.12.12.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-39407

CVE-2026-39407:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hono	npm	< 4.12.12	4.12.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the serveStatic middleware of the Hono framework. The root cause is an inconsistency in how paths with repeated slashes are handled by the routing layer versus the serveStatic middleware. An attacker can craft a URL with repeated slashes (e.g., //protected/resource) to bypass authorization middleware that is configured on a route without repeated slashes (e.g., /protected/*). The serveStatic function would then process this path, normalize it, and serve the file that should have been protected. The commit 9aff14bd727f8b0435c963363fd803260e7b8e3c directly addresses this by modifying the serveStatic function in src/middleware/serve-static/index.ts. The patch introduces a regular expression /[\\/\\\\]{2,}/ that explicitly disallows repeated slashes in the path, causing such requests to be rejected. Therefore, the serveStatic function is the vulnerable function as it is responsible for the improper path handling that leads to the authorization bypass.

Vulnerable functions

serveStatic

src/middleware/serve-static/index.ts

The `serveStatic` function is vulnerable because it incorrectly handles paths with repeated slashes. An attacker could use a path like `//admin/secret.txt` to bypass routing middleware that is configured to protect `/admin/*`. While the router fails to match the pattern, `serveStatic` normalizes the path and serves the protected file. The patch adds a regex check to reject paths with repeated slashes, thus preventing the bypass.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.