v4.13.11
honojs/honov4.13.11Sep 29, 2026by yusukebe
Upgrading?
AI Summary
Addresses a security vulnerability in serveStatic where path decoding could be bypassed to skip middleware.
Key Highlights
- Fix for GHSA-5r4p-p66f-jhc7 (path decoding bypass)
- Paths containing '%' are now rejected by default
- Fix applies to serveStatic and all adapters based on it
Breaking Changes
- Paths containing '%' characters are now rejected unless 'allowPercentInPath: true' is set
New Features
- New configuration option 'allowPercentInPath' to allow literal '%' in filenames
Full Release Notes
## Security fixes ### `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths Affects: `hono/serve-static` and the adapters built on it (`hono/bun`, `hono/deno`, `hono/cloudflare-workers`, `@hono/bun`, `@hono/deno`, `@hono/cloudflare-workers`). Fixes `serveStatic` decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7 `serveStatic` now rejects request paths that still contain `%` after decoding. To serve files whose names contain a literal `%`, set `allowPercentInPath: true`. The same fix ships in `@hono/node-server` v2.1.3.
Related Repositories
openclaw/openclaw★ 392,729
The AI that really does things. Any OS. Any Platform. The lobster way. 🦞
nilbuild/developer-roadmap★ 370,105
Interactive roadmaps, guides and other educational content to help developers grow in their careers.
morluto/rea★ 361,425
Reverse engineer anything with agents, from app behavior down to native binaries.
anomalyco/opencode★ 219,918
The open source coding agent.
n8n-io/n8n★ 208,293
Fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.