@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
Impact
The @hono/node-server package has a vulnerability where `serveStatic` decodes the request path twice, allowing an unauthenticated attacker to bypass middleware on static paths. This affects versions 1.19.10 to 2.1.3. The impact is that an attacker may reach static files without the middleware running.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 1.19.10 before 2.1.3Semantic versions | 2.1.3 |
Version evidence: OSV · GHSA-rmxm-3fg6-px4f
View original version evidence (0 explicit versions)
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
honojs · GitHub_M
node-server
1 range
honojs · GitHub_M
node-server
Compare with this publisher’s ranges. This does not inspect your installation.
affected
> = 1.19.10, < 2.1.3
Other versions: unknown
Original source description
Summary
serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix.
Details
Hono decodes the request path once before routing. serveStatic decoded it again before resolving the file. With a malformed percent-encoded sequence, the first decode leaves part of the path encoded, the router matches the encoded form, and the second decode resolves the real directory. The file is still resolved inside the configured root; this is not a traversal outside it.
Impact
An unauthenticated attacker may reach static files without the middleware on their prefix running, for example an authentication check. This affects applications that mount middleware on part of the directory served by serveStatic. Applications that serve only public files are not affected.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-118663View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changes- CVE · CVE-2026-118663
Observed 2026-10-29T18:49:13.210Z · upstream updated 2026-10-29T18:26:42.881Z
Prioritization updated
before
[]
after
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-10-29T18:26:31.513669Z", "decisions": [ { "name": "Exploitation", "value": "none" }, { "name": "Automatable", "value": "yes" }, { "name": "Technical Impact", "value": "partial" } ] } ]
Large field values are marked as truncated previews. Original source snapshots remain retained.
Showing up to 50 most recent observed changes.