---
id: "GHSA-74fm-fwc7-3fwp"
page: "https://infrastack.ai/live/GHSA-74fm-fwc7-3fwp"
kind: "vulnerability"
aliases: ["GHSA-74fm-fwc7-3fwp"]
title: "`serveStatic` with `allowPercentInPath` still decodes the path a second time, bypassing middleware on static paths"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "hono", "fixed": ["4.13.18"], "affected": ">= 4.13.11, <= 4.13.17", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["bun", "cwe-174", "deno", "hono", "node", "package", "servestatic"]
not_affected_if: ["default-config", "no-allowpercentinpath", "no-middleware-on-static-prefix"]
published_at: "2026-11-11T08:54:19+00:00"
first_seen_at: "2026-11-11T08:59:08+00:00"
updated_at: "2026-11-11T09:01:19+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/honojs/hono/security/advisories/GHSA-74fm-fwc7-3fwp", "first_seen_at": "2026-11-11T08:59:08+00:00"}]
exploit_sources: []
---

# `serveStatic` with `allowPercentInPath` still decodes the path a second time, bypassing middleware on static paths

Link for people: https://infrastack.ai/live/GHSA-74fm-fwc7-3fwp (this .md is for agents)

With the opt-in allowPercentInPath option enabled, Hono's serveStatic decodes request paths a second time, so a crafted URL can be routed as one path and served as another. An unauthenticated attacker can reach static files under a prefix without the middleware on that prefix, such as an authentication check, running.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:hono affected >= 4.13.11, <= 4.13.17 fixed 4.13.18

## How to check

- Look for `allowPercentInPath: true` in the `serveStatic` configuration.
- Check the installed version with `npm ls hono`; affected versions are `4.13.11` through `4.13.17`.
- Check whether middleware such as auth is mounted on a part of the directory served by `serveStatic`.

## Fix

- Upgrade `hono` to `4.13.18`.

## Timeline

- 2026-11-11T08:59:08+00:00 ghsa-repo https://github.com/honojs/hono/security/advisories/GHSA-74fm-fwc7-3fwp

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/honojs/hono/security/advisories/GHSA-74fm-fwc7-3fwp

## From the sources

### Summary

`serveStatic` has an opt-in option, `allowPercentInPath`, for serving files whose names contain a literal `%`. With it enabled, the check added for GHSA-5r4p-p66f-jhc7 that rejects a path containing `%` is skipped, and the path is decoded a second time. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix.

### Details

Hono decodes the request path once before routing. With a malformed percent-encoded sequence, that decode leaves part of the path encoded, the router matches the encoded form, and the second decode in `serveStatic` resolves the real directory. The option skipped the check without limiting what the second decode may change.

`serveStatic` now accepts a path that still contains `%` only when the second decode changes nothing except `%25`, the escape for a literal `%`. Anything else is treated as not found. File names such as `100%.txt` keep working. The file is still resolved inside the configured root; this is not a traversal outside it.

### Impact

An unauthenticated attacker may reach static files without the middleware on their prefix running, for example an authentication check. This affects applications that set `allowPercentInPath: true` and mount middleware on part of the directory served by `serveStatic`. The default configuration was fixed in 4.13.11 and is not affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_