CVE-2026-109955

A MODERATE severity flaw was found in the Hono web framework, an npm dependency shipped in several Red Hat products, including Red Hat Enterprise Linux and Red Hat In-Vehicle OS (grafana), Red Hat OpenShift Dev Spaces, Red Hat OpenShift AI, Migration Toolkit for Applications, Ansible Automation Platform and Ansible Services (MCP server images), and Red Hat Hardened Images (Hummingbird grafana images). The serveStatic middleware decodes the request path a second time after Hono has already decoded it once for routing. By sending a request with a crafted, malformed percent-encoded path, a remote, unauthenticated attacker can cause the router to match the encoded form of the path while the second decode resolves the real directory, so middleware mounted on a static prefix, such as an authentication check, is skipped and protected static files can be read without authentication. The requested file is still resolved within the configured root, so this is not a path traversal outside it, and applications that serve only public files without prefix middleware are not affected. Red Hat rates this flaw MODERATE with a CVSS 3.1 score of 5.3, consistent with the upstream severity. For most affected Red Hat products, the fix is deferred because no trackers are filed for moderate-impact flaws with a CVSS score below 7.0; the residual risk is unauthenticated disclosure of protected static files. For the Red Hat Hardened Images (Hummingbird) grafana components, the impact is the same and a fix is being pursued by the delegated image maintainers.