CVE-2026-54286 – Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

CVE ID :CVE-2026-54286

Published : June 22, 2026, 5:14 p.m. | 29 minutes ago

Description :Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the request path decodes to , which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as adminsecret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. This vulnerability is fixed in 4.12.25.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…