The vulnerability in Hono’s serveStatic middleware is an inconsistent encoding flaw (CWE‑177) that allows attackers to read protected static files. Hono’s router uses decodeURI while serveStatic uses decodeURIComponent, so request paths containing encoded slashes (%2F) can bypass route‑based middleware protections. Exploiting this mismatch grants unauthorized read access to filesystem resources, leading to disclosure of sensitive data.

Hono framework (honojs:hono) versions earlier than 4.12.4 are impacted. The issue exists in any JavaScript runtime that runs Hono and configures serveStatic in combination with route‑based middleware such as app.use('/admin/*', ...) for protecting static content.

The CVSS score of 7.5 indicates a high severity, but the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation. The likely attack vector is remote, delivered via crafted HTTP requests that target the web application’s static file endpoints. Exploitation requires prior deployment of Hono with serveStatic configured and route‑based middleware; no additional access or privileges are necessary. The risk remains moderate to high until the issue is fixed by upgrading the framework.