CVE-2026-39407

MEDIUM EPSS 36.5%
Published Apr 8, 20262mo ago · Modified Jun 17, 20262w ago
5.3 CVSS 3.1
Medium
Find Similar
Published Apr 8, 2026 2mo ago
Last Modified Jun 17, 2026 2w ago

Description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in 4.12.12.

CVSS Details

Base Score
5.3
Exploitability
3.9
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
36.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

Affected Products 1

VendorProductVersionRange
honohono* ≤4.12.11

References 3

  • github.com https://github.com/honojs/hono/commit/9aff14bd727f8b0435c963363fd803260e7b8e3c
    Patch
  • github.com https://github.com/honojs/hono/releases/tag/v4.12.12
    Release Notes
  • github.com https://github.com/honojs/hono/security/advisories/GHSA-wmmm-f939-6g9c
    Vendor Advisory

Remediation

  • github.com https://github.com/honojs/hono/commit/9aff14bd727f8b0435c963363fd803260e7b8e3c
    Patch