CVE-2026-29045 is a high severity (CVSS 7.5) authorization bypass in Hono before version 4.12.4. Paths with encoded slashes can skip route-based middleware while serveStatic still serves the matching file. Upgrade to 4.12.4 and recheck how you protect static files.
What's affected
The GitHub advisory lists the npm package hono before 4.12.4, with 4.12.4 as the fixed version.
You are affected only if you both protect subpaths with route-based middleware, such as app.use('/admin/*', ...), and serve files from the same static root with serveStatic. The advisory states that it does not allow access outside the static root and is not a path traversal bug.
How to check if you're exposed
Check the version:
npm ls hono
Then look for the two features together in your code:
grep -rn "serveStatic" src
If you protect paths by middleware and serve files from the same tree, plan the upgrade right away.
What to do now
- Upgrade
honoto 4.12.4 or later and update the lockfile. - Do not keep private files in the same static root as public ones. Serve protected files from a separate path that goes through checks.
- Add a test that requests protected static paths with encoded characters and expects a denial.
- Review access logs for requests containing encoded slashes against protected paths.
Why it matters
The record lists CWE-177, improper handling of URL encoding. The router decoded paths with one function, decodeURI, while serveStatic used another, decodeURIComponent. The two differ on encoded slashes. The router saw a literal encoded slash that did not match the protected pattern, and the static handler decoded it to a real slash and found the file.
It is another example of a check and an action disagreeing about a path. The impact here is bounded: files inside the static root, which the advisory says may have been exposed when only middleware protected them. Applications that keep secrets in a separate location are less affected. The record does not mark the CVE as exploited in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this a path traversal bug?
The advisory says no. It stays inside the configured static root, but it skips the middleware that was supposed to guard parts of that root.
Sources
Last reviewed: 19 October 2026.
