5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54286

CVE-2026-54286: hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the request path decodes to , which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. This vulnerability is fixed in 4.12.25.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54286

CVE-2026-54286:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hono	npm	< 4.12.25	4.12.25

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is a path traversal issue in the serve-static middleware of the Hono framework on Windows systems. The analysis started by identifying the patched version from the advisory, which is 4.12.25. By comparing the git tags for the patched version (v4.12.25) and the last vulnerable version (v4.12.24), I was able to isolate the specific commit that introduced the fix. The key change was found in the src/middleware/serve-static/index.ts file within the serveStatic function. The regular expression used for validating file paths was updated to disallow backslashes, which were the root cause of the path traversal on Windows. The commit 751ba41ba26dff20351a13964c07627ddcf382b6 contains this fix, along with a test case that confirms the vulnerability and the fix. Therefore, the serveStatic function is the identified vulnerable function, as it was responsible for processing the malicious input (the request path) without proper validation.

Vulnerable functions

serveStatic

src/middleware/serve-static/index.ts

The vulnerability exists in the `serveStatic` function, which is a middleware for serving static files. On Windows, an encoded backslash (`%5C`) in the request path is decoded to `\`, which is treated as a path separator. The original regular expression used to validate the file path did not account for backslashes, allowing a path traversal attack. An attacker could craft a URL like `/static/admin%5Csecret.txt` to access a file that should have been protected by a middleware guarding the `/admin` prefix. The patch adds `\\\\/` to the regex to explicitly block backslashes in the path, thus preventing the traversal.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.