CVE-2026-111757 honojs CVE debrief

Who should care

Defenders and administrators using Hono framework versions between 4.12.4 and 4.13.10 should assess exposure, especially in contexts where static prefixes are protected with upstream middleware.

Why it matters

CVE-2026-111757 allows unauthorized disclosure of static files in Hono framework versions between 4.12.4 and 4.13.10. Defenders should verify and upgrade to version 4.13.11, assess exposure in their deployment contexts, and review upstream middleware configurations.

• Verification of Hono version and exposure to potentially malicious percent-encoded paths
• Assessment of static prefix protection and potential for unauthorized file disclosure
• Upgrade to version 4.13.11 to fix the vulnerability
• Review of upstream middleware configurations for static prefix protection

Technical summary

The serveStatic component in Hono framework versions between 4.12.4 and 4.13.10 incorrectly handles malformed percent-encoded paths, allowing bypass of upstream middleware protection for static prefixes. This results in unauthorized disclosure of static files intended to be protected. Defenders should prioritize verifying and upgrading to version 4.13.11 if using Hono versions between 4.12.4 and 4.13.10, and assess exposure in their deployment contexts. The issue arises from serveStatic decoding a routed request path a second time before filesystem lookup, while upstream middleware interprets the path differently.

Defensive priority

Defenders should prioritize verifying and upgrading to version 4.13.11 if using Hono versions between 4.12.4 and 4.13.10, and assess exposure in their deployment contexts.

Recommended defensive actions

• Verify and upgrade to version 4.13.11 if using Hono versions between 4.12.4 and 4.13.10
• Assess exposure in deployment contexts where static prefixes are protected with upstream middleware
• Review and update inventory to ensure affected versions are identified and remediated
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix in version 4.13.11. Vendor and public sources confirm the issue and its resolution. Defenders should verify Hono versions, assess exposure in deployment contexts, and review upstream middleware configurations for static prefix protection. Evidence is limited to public CVE and NVD information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.