Starstruk Logo MarkStarstruk

v4.13.11

asheshgoplani/agent-deckv4.13.11Sep 29, 2026by yusukebe

Upgrading?

What changed from v0.64.7 → v4.13.11?What's new in v0.1.16 after v4.13.11?

AI Summary

A security fix addressing a bypass vulnerability in static file serving where request paths could be decoded twice, allowing middleware to be skipped.

Key Highlights

  • A vulnerability in `serveStatic` allowed crafted requests to be routed differently than intended, bypassing middleware.
  • The fix rejects request paths containing `%` after decoding.
  • Users serving files with literal `%` in names must set `allowPercentInPath: true`.

Breaking Changes

  • Request paths containing `%` will now be rejected unless `allowPercentInPath: true` is set.

New Features

  • Path validation to prevent double-decoding bypass
  • Configuration option for literal percent signs in filenames

Full Release Notes

## Security fixes

### `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

Affects: `hono/serve-static` and the adapters built on it (`hono/bun`, `hono/deno`, `hono/cloudflare-workers`, `@hono/bun`, `@hono/deno`, `@hono/cloudflare-workers`). Fixes `serveStatic` decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

`serveStatic` now rejects request paths that still contain `%` after decoding. To serve files whose names contain a literal `%`, set `allowPercentInPath: true`.

The same fix ships in `@hono/node-server` v2.1.3.

Related Repositories

ollama/ollama★ 184,217

Get up and running with Kimi, GLM, MiniMax, DeepSeek, gpt-oss, Qwen, Gemma and other models.

fatedier/frp★ 110,057

A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.

infiniflow/ragflow★ 92,619

RAGFlow is a leading open-source Retrieval-Augmented Generation (RAG) engine that fuses cutting-edge RAG with Agent capabilities to create a superior context layer for LLMs

gohugoio/hugo★ 90,198

The world’s fastest framework for building websites.

junegunn/fzf★ 83,715

:cherry_blossom: A command-line fuzzy finder