HONO · GHSA-74fm-fwc7-3fwp · Package
FIX → 4.13.18
With the opt-in allowPercentInPath option enabled, Hono's serveStatic decodes request paths a second time, so a crafted URL can be routed as one path and served as another. An unauthenticated attacker can reach static files under a prefix without the middleware on that prefix, such as an authentication check, running.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use Hono's serveStatic with allowPercentInPath set to true and mount middleware, such as authentication, on a path prefix inside the directory it serves. The default configuration was fixed in 4.13.11 and is not affected, so applications without the option can skip it.
Not affected if default-config, no-allowpercentinpath, no-middleware-on-static-prefix
Who cares bun, deno, hono, node, servestatic
allowPercentInPath: true in the serveStatic configuration.npm ls hono; affected versions are 4.13.11 through 4.13.17.serveStatic.serveStatic has an opt-in option, allowPercentInPath, for serving files whose names contain a literal %. With it enabled, the check added for GHSA-5r4p-p66f-jhc7 that rejects a path containing % is skipped, and the path is decoded a second time. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix.
Hono decodes the request path once before routing. With a malformed percent-encoded sequence, that decode leaves part of the path encoded, the router matches the encoded form, and the second decode in serveStatic resolves the real directory. The option skipped the check without limiting what the second decode may change.
serveStatic now accepts a path that still contains % only when the second decode changes nothing except %25, the escape for a literal %. Anything else is treated as not found. File names such as 100%.txt keep working. The file is still resolved inside the configured root; this is not a traversal outside it.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 4.13.18
hono to 4.13.18.An unauthenticated attacker may reach static files without the middleware on their prefix running, for example an authentication check. This affects applications that set allowPercentInPath: true and mount middleware on part of the directory served by serveStatic. The default configuration was fixed in 4.13.11 and is not affected.