Description (CNA)
Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths that the router matches in encoded form, reaching static files without authentication checks running.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| honojs / hono | affected 4.12.4 before 4.13.11; unaffected 4.13.11 |
CWE
CWE-174
References
- https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7
- https://www.vulncheck.com/advisories/hono-4.12.4-before-4.13.11-middleware-bypass-via-servestatic-double-decoding
ADP enrichment
No English description supplied.
No references supplied.