Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths.
Does it affect you?
Not read yetConditions are read within the hour after an advisory comes in.
Summary serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path once before routing. serveStatic decoded it again before resolving the file. With a malformed percent-encoded sequence, the first decode leaves part of the path encoded, the router matches the encoded form, and the second decode resolves the real directory. The file is still resolved inside the configure
Timeline
29 Sep- Published by GitHub advisory29 Sep
- Seen by Patchwire23 Oct
- Fix released29 Sep
Versions of hono
Related alerts(1)
Same packagesSource summary
Summary hono/jsx does not HTML-escape a plain string placed directly as a child or fallback of Suspense or ErrorBoundary , as the only child of a Context.Provider , or as the root value of renderToString() / renderToReadableStream() from hono/jsx/dom/server . Such a string is emitted as markup instead of text. Details These paths stringify their input and treat the result as already-escaped HTML, so a plain string passes through unchanged. Notable cases: - Suspense : a string child, or a string fallback while a child suspends. With streaming, the fallback reaches the browser in the initial chu
- Affected
- hono <4.13.7
- Fixed in
- 4.13.7
- ID
- GHSA-hxh3-vqpv-xpqv