---
id: CVE-2026-118663
title: >-
  @hono/node-server: `serveStatic` decodes the request path a second time,
  leading to bypass of middleware on static paths
summary: >-
  @hono/node-server allows running the Hono application on Node.js. From 1.19.10
  until 2.1.3, serveStatic decodes a request path a second time after Hono has
  already decoded it for routing, so a malformed percent-encoded sequence can
  make …
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-174
vendor: honojs
product: node-server
affected:
  - 'node-server > = 1.19.10, < 2.1.3'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-29T18:26:31.513669Z'
published: '2026-10-28'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T18:26:42.881Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118663'
references:
  - url: >-
      https://github.com/honojs/node-server/security/advisories/GHSA-rmxm-3fg6-px4f
    label: >-
      https://github.com/honojs/node-server/security/advisories/GHSA-rmxm-3fg6-px4f
  - url: >-
      https://github.com/honojs/node-server/commit/982179278529d5673812116b042829f27794966f
    label: >-
      https://github.com/honojs/node-server/commit/982179278529d5673812116b042829f27794966f
  - url: 'https://github.com/honojs/node-server/releases/tag/v2.1.3'
    label: 'https://github.com/honojs/node-server/releases/tag/v2.1.3'
  - url: 'https://github.com/advisories/GHSA-rmxm-3fg6-px4f'
tags:
  - cve.org
  - ghsa
  - npm
aliases:
  - GHSA-rmxm-3fg6-px4f
ecosystem: npm
patched:
  - '@hono/node-server 2.1.3'
epss: 0.00353
epssPercentile: 0.28979
ingestedAt: '2026-10-28T21:18:49.946Z'
---

## Overview

@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file resolution uses a different directory. An unauthenticated attacker can bypass middleware mounted on a protected static prefix and read a file inside the configured static root, although the flaw does not permit traversal outside that root. This issue is fixed in version 2.1.3.

## Affected

- `node-server > = 1.19.10, < 2.1.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-118663)

Affected packages:

- `@hono/node-server >= 1.19.10, < 2.1.3`

Patched in:

- `@hono/node-server 2.1.3`

Source: https://github.com/advisories/GHSA-rmxm-3fg6-px4f