Threats affecting pkg:github/honojs/hono

A vulnerability in the honojs hono web framework versions 4.12.4 through 4.13.10 allows unauthorized disclosure of static files protected by upstream middleware. The serveStatic component decodes a malformed percent-encoded path twice, causing it to bypass static prefix protections. This flaw does not allow directory traversal outside the static root. The issue is fixed in version 4.13.11.

A vulnerability in the honojs hono web application framework prior to version 4.12.12 allows bypass of cookie prefix protections due to inconsistent handling between browser cookie parsing and the parse() function. This discrepancy enables attacker-controlled cookies to override legitimate cookies by exploiting normalization differences. The issue is fixed in version 4.12.12. The vulnerability has a medium severity with a CVSS score of 4.8.