The vulnerability arises when Hono’s serveStatic middleware performs a second decoding of a percent‑encoded request path before accessing the filesystem. An attacker can send a specially crafted URL, which bypasses any upstream middleware guarding a static prefix and reveals a file that should have been protected. Only files under the configured static root can be accessed, and traversal outside that root is not possible.

All installations of the Hono web application framework from version 4.12.4 up to and including 4.13.10 are affected. Clients using the serveStatic module in these releases are exposed unless they upgrade to 4.13.11 or later.

The CVSS score of 5.3 indicates a moderate severity. No EPSS data is reported, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it has not been widely exploited yet. An attacker would need to send an HTTP request with a double‑encoded path that survives the first routing stage; once the request reaches serveStatic, the second decoding exposes the protected file. The likely attack vector, based on the description, is remote via a normal web request, and the condition is an application that applies middleware to protect a static prefix before calling serveStatic.