Cloudanix VulnDB

CVE-2026-29045

High · 7.5

CVSS

7.5

EPSS

0.6%

Published

Mar 4, 2026

CISA due date

—

The record

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path. This issue has been patched in version 4.12.4.

Affected packages

Ecosystem Package Introduced Fixed
npm hono 0 4.12.4
Chainguard hono 0 0
Chainguard hono-adapter-mqtt 0 0
Chainguard hono-cli 0 0
Chainguard hono-compat 0 0
Chainguard hono-service-auth 0 0
Chainguard hono-service-command-router 0 0
Chainguard hono-service-device-registry-jdbc 0 0
Chainguard kibana-9.1 0 9.1.10-r7
Chainguard kibana-9.1-iamguarded 0 9.1.10-r7
Chainguard librechat 0 0.8.3-r1
Chainguard opensearch-dashboards-2 0 2.19.5-r3
Chainguard opensearch-dashboards-2-fips 0 2.19.5-r1
Wolfi opensearch-dashboards-2 0 2.19.5-r3

Related vulnerabilities