Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding survives the first routing interpretation and becomes a protected path only during the later static-file decode. The affected component is serveStatic. The trigger conditions are an application protects a static prefix with upstream middleware and serveStatic receives an attacker-controlled malformed percent-encoded path. The impact is unauthorized disclosure of a static file that upstream middleware was intended to protect. The issue does not permit traversal outside the configured static root. This issue is fixed in version 4.13.11.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until
    4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing
    middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed
    request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding
    survives the first routing interpretation and becomes a protected path only during the later static-file
    decode. The affected component is serveStatic. The trigger conditions are an application protects a static
    prefix with upstream middleware and serveStatic receives an attacker-controlled malformed percent-encoded
    path. The impact is unauthorized disclosure of a static file that upstream middleware was intended to
    protect. The issue does not permit traversal outside the configured static root. This issue is fixed in
    version 4.13.11. (CVE-2026-111757)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until     4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing     middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed     request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding     survives the first routing interpretation and becomes a protected path only during the later static-file     decode. The affected component is serveStatic. The trigger conditions are an application protects a static     prefix with upstream middleware and serveStatic receives an attacker-controlled malformed percent-encoded     path. The impact is unauthorized disclosure of a static file that upstream middleware was intended to     protect. The issue does not permit traversal outside the configured static root. This issue is fixed in     version 4.13.11. (CVE-2026-111757)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
476350	SCA: security update for hono (GHSA-5r4p-p66f-jhc7)	Tenable Cloud Security	SCA Checks	Local	medium
476350	SCA: security update for hono (GHSA-5r4p-p66f-jhc7)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
367587	Linux Distros Unpatched Vulnerability : CVE-2026-111757	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-111757

medium

Tenable Plugins

medium

medium

medium