## Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-111757
- 公開日時: 2026-10-20T14:36:11.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-5r4p-p66f-jhc7)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-5r4p-p66f-jhc7

影響: npm:hono >= 4.12.4, < 4.13.11 → 4.13.11
Summary serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path once before routing. serveStatic decoded it again before resolving the file. With a malformed percent-encoded sequence, the first decode leaves part of the path encoded, the router matches the encoded for…