Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Fixed packages 1

Vulnerabilities 2

• Medium 5.3
  CVE-2026-109955

  Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding

  Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths that the router ma…

  honojs hono hono npm
  Oct 13, 2026
• Medium 5.3
  CVE-2026-111757

  Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

  Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix.…

  honojs hono
  Oct 19, 2026

References

• report
  https://access.redhat.com/security/cve/CVE-2026-109955
• article
  https://access.redhat.com/security/updates/classification/
• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-111757
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84423.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550544
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-109955
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-109955
• article
  https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7
• article
  https://www.vulncheck.com/advisories/hono-4.12.4-before-4.13.11-middleware-bypass-via-servestatic-double-decoding
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2555734
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-111757
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-111757
• article
  https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc