p PatchFirst

PatchFirst · Latest vulnerabilities

hono 4.13.7: known vulnerabilities

Known vulnerabilities affecting hono 4.13.7: 1. Compare the fixes below with your installed release.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 1

  1. CVE-2026-109955

    Medium · CVSS 6.9EPSS 0.32%Fix available

    Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding

    Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths that the router matches in encoded form, reaching static files without authentication checks running.

    honoNode.js
    • Update to 4.13.11
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →