Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-29045: Apache Hono allows unauthorized access to protected files

CVE-2026-29045 · published 8 months ago

Summary

Apache Hono has a bug that lets attackers access files they shouldn't see by using special characters in the URL. If you're using Hono to protect certain files with route-based middleware, you may need to update your setup to prevent unauthorized access. Check your configuration and consider upgrading to a fixed version of Hono.

What to do

Update yusukebe hono to version 4.12.4.
Update rootio @rootio/hono to version 4.11.7-root.io.4.
Update GitHub Actions hono to version 4.11.7-aikido.6.
Update rootio @rootio/hono to version 4.11.7-root.io.6.
Update GitHub Actions hono to version 4.12.4.
Update hono hono to version 4.12.4 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	yusukebe	hono	< 4.12.4 Fix: upgrade to 4.12.4
–	hono	hono	< 4.12.4 `cpe:2.3:a:hono:hono::::::node.js::*`
Root:npm	rootio	@rootio/hono	< 4.11.7-root.io.4 < 4.11.7-root.io.6 Fix: upgrade to 4.11.7-root.io.4
Root:npm	GitHub Actions	hono	< 4.11.7-aikido.6 Fix: upgrade to 4.11.7-aikido.6
npm	GitHub Actions	hono	< 4.12.4 Fix: upgrade to 4.12.4

Original advisory text

Hono: Arbitrary file access via serveStatic vulnerability

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path. This issue has been patched in version 4.12.4.

References

https://github.com/advisories/GHSA-q5qw-h33p-qvwr
https://nvd.nist.gov/vuln/detail/CVE-2026-29045 Vendor Advisory
https://github.com/honojs/hono Product
https://github.com/honojs/hono/commit/6a0607a929d888893f0c91d92dce2fcfdb3662a3 Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29045... Vendor Advisory
https://github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-177Improper Handling of URL Encoding (Hex Encoding)

Timeline

Published4 Mar 2026

Updated4 Nov 2026

First seen6 Mar 2026

Sources

ROOT-APP-NPM-CVE-2026-29045 · OSV

CVE-2026-29045 · NVD

GHSA-q5qw-h33p-qvwr · GHSA

GHSA-q5qw-h33p-qvwr · OSV

CVE-2026-29045 · OSV

Track software like this

Free during beta