CVE-2026-29045: 
JavaScript vulnerability analysis and mitigation

CVE-2026-29045 is an authorization bypass vulnerability in the Hono Web application framework, classified as "Arbitrary file access via serveStatic vulnerability." It affects all Hono versions prior to 4.12.4 (npm package) and was published on March 3, 2026, by maintainer yusukebe via a GitHub Security Advisory. The vulnerability stems from inconsistent URL decoding between the router and the serveStatic middleware, allowing unauthenticated attackers to access protected static resources. The CVSS v3.1 base score is 7.5 (High) per the official advisory, though some sources estimate it as high as 9.8 (GitHub Advisory, Hono Security Advisory).

The root cause is CWE-177 (Improper Handling of URL Encoding / Hex Encoding): Hono's router used decodeURI to process incoming request paths, while the serveStatic middleware used decodeURIComponent to resolve filesystem paths. Because decodeURIComponent decodes %2F into / while decodeURI does not, a request to /admin%2Fsecret.html would be seen by the router as /admin%2Fsecret.html (not matching the /admin/* middleware pattern), but serveStatic would resolve it to the filesystem path /admin/secret.html and serve the file. The fix, applied in commit 6a0607a, replaced decodeURIComponent in serveStatic with tryDecodeURI (which wraps decodeURI), ensuring both layers use the same decoding behavior. This vulnerability only affects applications that both protect subpaths with route-based middleware and serve files from the same static root using serveStatic; it does not enable path traversal outside the static root (Hono Security Advisory, Patch Commit).

Successful exploitation allows an unauthenticated remote attacker to bypass route-based authorization controls and directly access protected static files — such as configuration files, credentials, or private user data — stored under protected directories (e.g., /admin/*). The primary impact is a high confidentiality loss; integrity and availability are not directly affected by this vulnerability. Applications relying solely on Hono's route-based middleware to protect static subpaths are fully exposed, and the scope of exposed data depends entirely on what files are served from the protected static root (GitHub Advisory, Hono Security Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.05% (16th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication, no user interaction, and low complexity — making it trivially exploitable against any vulnerable, internet-facing Hono application that meets the preconditions.

1. Reconnaissance: Identify web applications built with Hono (npm) versions prior to 4.12.4 that serve static files using serveStatic and protect subpaths with route-based middleware (e.g., app.use('/admin/*', authMiddleware)).
2. Identify protected resources: Browse or enumerate the application to identify static resources under protected paths (e.g., /admin/config.json, /admin/secret.html).
3. Craft encoded request: Replace the slash (/) separating the protected path segment with its percent-encoded equivalent %2F. For example, instead of requesting /admin/secret.html, request /admin%2Fsecret.html.
4. Send the request: Issue an HTTP GET request with the encoded path: GET /admin%2Fsecret.html HTTP/1.1. The router evaluates /admin%2Fsecret.html, which does not match the /admin/* middleware pattern, so the auth middleware is skipped.
5. Receive protected file: The serveStatic handler decodes %2F to /, resolves the path to /admin/secret.html on the filesystem, and returns the file contents without authorization checks (Hono Security Advisory, Patch Commit).

• Network: HTTP GET requests to paths containing %2F in place of directory separators (e.g., /admin%2F<filename>), particularly to paths that correspond to known protected static resources; absence of expected authorization headers (e.g., X-Authorized, Authorization) in responses to such requests.
• Logs: Web server or application access logs showing requests with percent-encoded slashes (%2F) in the URL path that return HTTP 200 responses for resources under protected directories (e.g., /admin%2Fconfig.json returning 200 instead of 401/403).
• Application Behavior: Successful retrieval of files from protected static directories without triggering authentication middleware, observable by the absence of middleware-set response headers on those responses.

The primary remediation is to upgrade the Hono npm package to version 4.12.4 or later, which replaces decodeURIComponent with tryDecodeURI in serveStatic to ensure consistent URL decoding across the router and static file handler (Hono Security Advisory, Patch Commit). As a temporary workaround for organizations unable to upgrade immediately, implement additional URL normalization in middleware to decode and normalize incoming request paths before route matching, ensuring %2F is consistently handled. Additionally, consider supplementing route-based middleware with file-level access controls or serving protected static files from a separate root not covered by serveStatic. IBM has also released patches for affected products including IBM DevOps Solution Workbench, IBM API Connect, IBM Db2 on Cloud Pak for Data, and IBM watsonx Orchestrate (IBM DevOps Advisory, IBM API Connect Advisory).

The vulnerability was reported by security researchers techfish-11 and EdamAme-x and was promptly patched by Hono maintainer yusukebe (Hono Security Advisory). The issue received coverage from several vulnerability tracking and security news outlets shortly after disclosure, including thehackerwire.com and infinitsec.net. IBM subsequently issued multiple security bulletins acknowledging the impact on its products that bundle Hono as a dependency, indicating broad downstream reach of the vulnerability.