{"id":"CVE-2026-118663","title":"@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths","summary":"@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make …","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-174"],"vendor":"honojs","product":"node-server","affected":["node-server > = 1.19.10, < 2.1.3"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-29T18:26:31.513669Z"},"published":"2026-10-28","updated":"2026-10-29","sourceUpdated":"2026-10-29T18:26:42.881Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118663","references":[{"url":"https://github.com/honojs/node-server/security/advisories/GHSA-rmxm-3fg6-px4f","label":"https://github.com/honojs/node-server/security/advisories/GHSA-rmxm-3fg6-px4f"},{"url":"https://github.com/honojs/node-server/commit/982179278529d5673812116b042829f27794966f","label":"https://github.com/honojs/node-server/commit/982179278529d5673812116b042829f27794966f"},{"url":"https://github.com/honojs/node-server/releases/tag/v2.1.3","label":"https://github.com/honojs/node-server/releases/tag/v2.1.3"},{"url":"https://github.com/advisories/GHSA-rmxm-3fg6-px4f"}],"tags":["cve.org","ghsa","npm"],"aliases":["GHSA-rmxm-3fg6-px4f"],"ecosystem":"npm","patched":["@hono/node-server 2.1.3"],"epss":0.00353,"epssPercentile":0.28979,"ingestedAt":"2026-10-28T21:18:49.946Z","slug":"CVE-2026-118663","body":"## Overview\n\n@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file resolution uses a different directory. An unauthenticated attacker can bypass middleware mounted on a protected static prefix and read a file inside the configured static root, although the flaw does not permit traversal outside that root. This issue is fixed in version 2.1.3.\n\n## Affected\n\n- `node-server > = 1.19.10, < 2.1.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-118663)\n\nAffected packages:\n\n- `@hono/node-server >= 1.19.10, < 2.1.3`\n\nPatched in:\n\n- `@hono/node-server 2.1.3`\n\nSource: https://github.com/advisories/GHSA-rmxm-3fg6-px4f","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}