The vulnerability is located in the serveStatic middleware of the Hono web framework. A double decoding of percent‑encoded path segments allows an unauthenticated attacker to bypass any prefix middleware that normally enforces authentication. By sending a specially crafted URL with double‑encoded characters, the router interprets the path in its encoded form and routes the request directly to a static file, thereby disabling the intended authentication checks and exposing potentially sensitive content.

Affected versions include Hono 4.12.4 up to but excluding 4.13.11. The product is the open‑source Hono framework provided by honojs. Any deployment that uses serveStatic in these vulnerable releases and exposes it without additional safeguards is at risk.

The CVSS v3.1 score of 6.9 reflects moderate impact. The EPSS score of <1% indicates a low probability of exploitation at present, and the vulnerability is not listed in CISA's KEV catalog. Attackers can send a malicious double‑percent‑encoded URL to bypass authentication checks and retrieve static files. While the flaw can be remotely exploited without prior access, the current EPSS suggests that real‑world attacks are unlikely at this time, though the vulnerability remains technically feasible.