CVE-2026-29045: Hono vulnerable to arbitrary file access via serveStatic vulnerability

March 4, 2026 (updated March 5, 2026)

When using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization.

The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path.

References

github.com/advisories/GHSA-q5qw-h33p-qvwr
github.com/honojs/hono
github.com/honojs/hono/commit/6a0607a929d888893f0c91d92dce2fcfdb3662a3
github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr
nvd.nist.gov/vuln/detail/CVE-2026-29045

Code Behaviors & Features

Detect and mitigate CVE-2026-29045 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →