CVE-2026-29045: Hono Package Arbitrary File Access Vulnerability
Summary
CVE-2026-29045: Hono vulnerable to arbitrary file access via serveStatic vulnerability. Affects hono versions < 4.12.4. Fixed in 4.12.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hono is a lightweight web framework for building web applications and APIs in Node.js. It is designed for performance and simplicity, providing developers with a robust set of features to create efficient applications. However, it has a vulnerability related to its serveStatic functionality, which can lead to unauthorized access to protected static resources under certain conditions.
Vulnerability Detail
The vulnerability arises from inconsistent URL decoding between the routing layer and the serveStatic middleware in Hono. Specifically, the router uses decodeURI, while serveStatic employs decodeURIComponent. This discrepancy allows attackers to bypass route-based middleware protections by crafting requests with encoded slashes (e.g., %2F). For instance, a request for /admin%2Fsecret.html would not match the route protection but would still resolve to the intended file path, exposing sensitive resources. This issue does not allow access outside the static root, nor is it a path traversal vulnerability, but it does enable unauthorized access to protected files.
How To Fix
Latest published version: 4.13.13 as of 23 Oct 2026
npm install hono@4.13.13Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.12.4
This is the first release that contains the fix.
npm install hono@4.12.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional checks in your middleware to validate the requested paths before serving static files. For example, you can restrict access to certain paths explicitly in your middleware logic, ensuring that only authorized users can access sensitive resources.
Conclusion
The CVE-2026-29045 vulnerability in the Hono package poses a significant risk by allowing unauthorized access to protected static resources. It is crucial to update to version 4.12.4 or later to mitigate this risk. Additionally, using Vulert can help monitor and alert for such vulnerabilities in real-time, ensuring your application remains secure.
See every vulnerability recorded for hono →
FAQ
CVE-2026-29045 is a vulnerability in the Hono package that allows unauthorized access to protected static resources due to inconsistent URL decoding.
If your application uses Hono and serves static files while relying on route-based middleware for protection, this vulnerability could allow unauthenticated users to access sensitive files.
All versions of Hono prior to 4.12.4 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package right away, consider implementing additional middleware checks to restrict access to sensitive static resources as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for hono.
