Packages / hono / Security

ModerateVulnerabilityGHSA-5r4p-p66f-jhc7Published 20 Oct 2026

Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

Affected releases · hono

  • 4.x4.12.4 – 4.13.10Fixed in 4.13.11

On 4.x, the newest line:

npm install hono@4.13.11

  1. Not affected

    0.0.1 – 4.12.3

    365 releases

  2. Affected

    4.12.4 – 4.13.10

    42 releases

  3. Fixed

    4.13.11 – 4.13.13

    3 releases, latest

410 stable releases of hono, oldest to newest.

Is your project affected?

Paste your package.json, or type the range you declare for hono. It is read in your browser and sent nowhere.

What happens

The full text is not stored yet. Read it on osv.dev.