The flaw arises from Hono’s serveStatic component normalizing double slashes in request paths, allowing a crafted URL with repeated slashes to bypass route‑based middleware that protects protected static files. This path handling inconsistency is a CWE‑22 weakness, which can lead to unauthorized access to sensitive data.

The vulnerability impacts the Hono web application framework from honojs. Versions prior to 4.12.12 are vulnerable when serveStatic is used to expose static resources behind authorization middleware such as /admin/*. The issue applies to any JavaScript runtime that runs a affected Hono release and serves protected static files.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is reported and the flaw is not listed in the CISA KEV catalog. An attacker can remotely trigger the bypass by sending an HTTP request with repeated slashes to the target server; the framework normalizes the path while the router fails to match the middleware rule, resulting in unauthorized exposure of protected content.