CVE-2026-118663

    Dashboard / Vulnerabilities / CVE-2026-118663

    CVE-2026-118663

    Published: 28 Oct 2026Last Modified: 31 Oct 2026

    Summary: @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

    Details: @hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file resolution uses a different directory. An unauthenticated attacker can bypass middleware mounted on a protected static prefix and read a file inside the configured static root, although the flaw does not permit traversal outside that root. This issue is fixed in version 2.1.3.

    References: https://github.com/honojs/node-server/releases/tag/v2.1.3, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118663.json, https://github.com/honojs/node-server/security/advisories/GHSA-rmxm-3fg6-px4f, https://nvd.nist.gov/vuln/detail/CVE-2026-118663, https://github.com/honojs/node-server/commit/982179278529d5673812116b042829f27794966f

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 2f8ca3665f5257305603783ec9999bd1a9bec0f2
    Fixed -720ac7843fbc7c1bdae1beaa47e2ab5db7f99a9b

    Affected versions

    v2.1.2
    v2.1.1
    v2.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-118663 | CVE-DB