CWE-174

CVEs classified under CWE-174, newest first.

5 CVEsRSS

CVE-2026-111757Medium· 5.3

hono: hono: Information disclosure via malformed percent-encoded paths in serveStatic (CVE-2026-111757)

A flaw was found in Hono's serveStatic middleware. This vulnerability allows a remote attacker to cause unauthorized information disclosure by bypassing path-based access controls. Because serveStatic decodes request paths a second time be…

▾ SunlitRed Hat · Red Hat Hardened ImagesEPSS 0.31%via CSAF

CVE-2026-109955Medium· 5.3

2w ago

Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding

Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded pa…

▾ Sunlithonojs · honoEPSS 0.32%via NVD

CVE-2026-93903Critical· 9.4

4w ago

LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."

▾ Midnightlitespeedtech · LiteSpeed Web ServerEPSS 0.26%via NVD

CVE-2026-92839Medium· 4.3

1mo ago

Canva Desktop before v1.125.0 performed double decoding in the deeplink handler

Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin content under the user’s session.

▾ SunlitCanva · CanvaEPSS 0.28%via NVD

CVE-2026-75899High· 7.5

2mo ago

fast-uri is a URI parser for Node.js

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested per…

▾ Twilightopenjsf · fast-uriEPSS 0.22%via NVD