{"id":"CVE-2026-54286","aliases":["GHSA-wwfh-h76j-fc44"],"title":"hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)","summary":"hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)","severity":"medium","cvss":5.9,"cwe":["CWE-22"],"vendor":"hono","product":"hono","ecosystem":"npm","affected":["hono < 4.12.25"],"patched":["hono 4.12.25"],"published":"2026-06-16","updated":"2026-06-16","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-wwfh-h76j-fc44","references":[{"url":"https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44"},{"url":"https://github.com/advisories/GHSA-wwfh-h76j-fc44"}],"tags":["ghsa","npm"],"epss":0.00433,"epssPercentile":0.37108,"ingestedAt":"2026-07-07T15:41:58.359Z","slug":"CVE-2026-54286","body":"## Overview\n\n### Summary\n\nOn Windows hosts, an encoded backslash (`%5C`) in the request path decodes to `\\`, which the Windows path resolver treats as a separator. `serve-static` then resolves a single URL segment such as `admin\\secret.txt` into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. Directory escape (`..`) remains blocked.\n\n### Details\n\nThe router splits paths only on `/`, so `/admin%5Csecret.txt` is one segment and middleware on `/admin/*` does not run. The `serve-static` guard rejects `.`/`..` and consecutive separators but lets a lone `\\` through; on Windows the file resolver re-splits it into the protected subtree.\n\nThis affects Windows hosts serving static files via the Node, Bun, or Deno adapters that guard a static subtree with prefix-mounted middleware.\n\n### Impact\n\nAn unauthenticated attacker can read static files under a middleware-guarded prefix on Windows hosts. The read stays within the configured root; escape outside the root is not possible.\n\n## Affected packages\n\n- `hono < 4.12.25`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `hono 4.12.25`","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}