Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118663— @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

Quick assessment

Affected
honojs node-server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

允许在 Node.js 环境中运行 Hono 应用。在 1.19.10 到 2.1.3 版本中， 在 Hono 已为路由完成一次路径解码后，又对请求路径进行了第二次解码。因此，一个构造异常的百分号编码序列可能导致路由中间件基于编码后的路径进行判断，而静态文件解析却使用了不同的目录路径。未认证的攻击者可借此绕过挂载在受保护静态前缀上的中间件，读取配置静态根目录内的文件；但该漏洞无法用于访问该根目录之外的文件。此问题已在 2.1.3 版本中修复。

CVSS 5.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118663

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
Source: CVE Program / CVE List V5
Vulnerability Description
@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file resolution uses a different directory. An unauthenticated attacker can bypass middleware mounted on a protected static prefix and read a file inside the configured static root, although the flaw does not permit traversal outside that root. This issue is fixed in version 2.1.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对同一数据的双重编码
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
honojs node-server > = 1.19.10, < 2.1.3 -

II. Public POCs for CVE-2026-118663

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118663

请登录查看更多情报信息。

Other References for CVE-2026-118663 (3)

IV. Related Vulnerabilities

Same product: node-server
Same vendor: honojs
Same weakness: CWE-174