Technical impact
The vulnerability allows an attacker to read static files located outside the intended serving directory on Windows hosts. An encoded backslash in the request path is decoded to a literal backslash, which Windows treats as a path separator. The serve‑static module then resolves the path to the nested file and serves it, bypassing any prefix‑mounted middleware that might normally protect the file. This results in disclosure of potentially sensitive data, such as configuration files or other protected content.
Affected Systems
Hono framework prior to version 4.12.25, used on Windows environments. Any deployment of Hono before that release that serves static content via serve‑static is potentially affected. Versions 4.12.25 and later are not affected.
Risk and Exploitability
The vulnerability has a CVSS score of 5.9 and is not listed in the CISA KEV catalog. The EPSS score is not available, indicating no publicly known exploitation yet. Attack requires sending a crafted HTTP request with an encoded backslash, which a remote attacker can do via the public internet if the Hono application is exposed. The solution is straightforward: upgrade to 4.12.25 or later. Until then, an attacker can read unprotected files through the static file serving endpoint.
Github GHSA