The vulnerability resides in the serveStatic middleware of Hono 4.12.4 through 4.13.10. A double decoding of percent‑encoded path segments allows an unauthenticated attacker to bypass any prefix middleware that would normally enforce authentication. By sending a specially crafted URL that contains double‑encoded characters, the router interprets the path in its encoded form and routes the request directly to a static resource. The result is that sensitive files can be served without the expected authentication checks, leading to unauthorized disclosure of content.

Affected versions include Hono 4.12.4 up to, but not including, 4.13.11. The product is the open‑source web framework Hono provided by honojs. Any deployment that relies on these vulnerable releases and exposes serveStatic without additional safeguards is at risk.

The CVSS v3.1 score of 6.9 indicates a moderate impact with an exploitation vector of network and unauthenticated access; the EPSS score is not available. The vulnerability is not listed in CISA's KEV catalog. Attackers can remotely exploit the flaw by sending a malicious URL from any client, with no credentials required. The vulnerability is easily triggered by simply using a double percent‑encoded path, so the likelihood of exploitation among systems that expose the affected serveStatic route is high.