[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
hono (source)	4.13.9 → 4.13.11

---

Hono: serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

CVE-2026-111757 / GHSA-5r4p-p66f-jhc7

More information

Details

Summary

serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix.

Details

Hono decodes the request path once before routing. serveStatic decoded it again before resolving the file. With a malformed percent-encoded sequence, the first decode leaves part of the path encoded, the router matches the encoded form, and the second decode resolves the real directory. The file is still resolved inside the configured root; this is not a traversal outside it.

Impact

An unauthenticated attacker may reach static files without the middleware on their prefix running, for example an authentication check. This affects applications that mount middleware on part of the directory served by serveStatic. Applications that serve only public files are not affected.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7
• https://nvd.nist.gov/vuln/detail/CVE-2026-111757
• https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc
• https://github.com/honojs/hono/releases/tag/v4.13.11
• https://github.com/advisories/GHSA-5r4p-p66f-jhc7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

honojs/hono (hono)

v4.13.11

Compare Source

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in @hono/node-server v2.1.3.

v4.13.10

Compare Source

Adapters are now separate packages

The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:

- import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'

hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.

What's Changed

• chore: migrate the package manager from bun to pnpm in #​5433
• chore(package.json): invoke package scripts through pnpm instead of bun in #​5434
• chore: replace prettier with oxfmt in #​5435
• chore(deps): upgrade vitest to 5.0.1 in #​5437
• chore: let oxfmt sort imports instead of eslint in #​5442
• chore: replace eslint with oxlint in #​5443
• chore: introduce Vite+ in #​5444
• fix(types): allow returning a Blob as a response body in #​5446
• chore: convert build scripts into plugins in #​5448
• chore: stop editorconfig-checker from checking Markdown indent size in #​5455
• ci: remove empty step left in cr.yml by the pnpm migration in #​5456
• chore(deps): upgrade vite-plus to 1.0.0-rc.1 in #​5459
• feat(adapters): add @​hono/bun as a workspace package in #​5447
• chore(adapters/bun): ship ESM only in #​5462
• feat(adapters): add the seven adapters as workspace packages in #​5463
• feat(adapters/deno): publish to JSR in #​5465
• test: move adapter runtime tests into adapters/* in #​5466

Full Changelog: honojs/hono@v4.13.9...v4.13.10

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 46a09d43-9822-43c7-94db-c3fb98240789

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}