CVE-2026-29045

CVE-2026-29045 is a critical vulnerability affecting Hono, a JavaScript web application framework, prior to version 4.12.4. It allows unauthorized access to protected static resources due to inconsistent URL decoding between the router and the serveStatic function, enabling attackers to bypass middleware protections using encoded slashes. This vulnerability has a CVSS score of 9.8 (Critical), indicating a severe impact with high confidentiality, integrity, and availability compromise, and can be exploited remotely without authentication or user interaction. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant media coverage, though it has garnered some community discussion.