Search: CVE-2026-109955

A middleware bypass vulnerability exists in hono versions from 4.12.4 up to but not including 4.13.11. This flaw in the serveStatic middleware allows unauthenticated attackers to bypass prefix middleware by exploiting double decoding of percent-encoded paths, enabling access to static files without authentication checks.