Read the docs
TI-2026-82204 Aliases CVE-2026-118663GHSA-rmxm-3fg6-px4f

Double decoding in @hono/node-server serveStatic bypasses middleware

Priority LOW 30CWE-174Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

@hono/node-server from 1.19.10 before 2.1.3 is affected. serveStatic decodes the request path a second time after Hono has already decoded it for routing, which is a double decoding flaw (CWE-174). An unauthenticated remote attacker can bypass middleware mounted on a protected static prefix and read a file inside the configured static root. Traversal outside that root is not possible.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file resolution uses a different directory. An unauthenticated attacker can bypass middleware mounted on a protected static prefix and read a file inside the configured static root, although the flaw does not permit traversal outside that root. This issue is fixed in version 2.1.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00353 29th percentileScored 2026-11-07
Fix Fixed @hono/node-server (npm): 2.1.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
honojsnode-server> = 1.19.10, < 2.1.3—No fix listedCNA
—@hono/node-server (npm)1.19.10 to before 2.1.32.1.3Patch availableGHSA-rmxm-3fg6-px4f
  • node-server Vendorhonojs Affected > = 1.19.10, < 2.1.3 Fixed in — No fix listed CNA
  • @hono/node-server (npm) Vendor— Affected 1.19.10 to before 2.1.3 Fixed in 2.1.3 Patch available GHSA-rmxm-3fg6-px4f

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:hono:node-server:*:*:*:*:*:*:*:*——honojs
  • cpe:2.3:a:hono:node-server:*:*:*:*:*:*:*:* Versions — — ·honojs

Remediation

Upgrade @hono/node-server to version 2.1.3, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · GHSA-rmxm-3fg6-px4f @hono/node-server (npm) Fixed in 2.1.3 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-118663
  2. 2026-10-28 Alias added: GHSA-rmxm-3fg6-px4f
  3. 2026-10-28 Fix available: npm/@hono/[email protected] · GHSA-rmxm-3fg6-px4f
  4. 2026-10-28 CVSS score added · GHSA-rmxm-3fg6-px4f
  5. 2026-10-28 Weakness changed · GHSA-rmxm-3fg6-px4f
  6. 2026-10-28 4 new references · GHSA-rmxm-3fg6-px4f
  7. 2026-10-29 CISA SSVC decision points changed
  8. 2026-11-06 Affected versions changed · Red Hat
  9. 2026-11-06 CVSS score added · Red Hat

References

Other 4

  • TI-2024-21741 Hono vulnerable to Restricted Directory Traversal in serveStatic with deno CVSS 3.1MEDIUM 5.3
  • TI-2024-15441 @hono/node-server can't handle "double dots" in URL CVSS 3.1MEDIUM 5.3
  • TI-2024-32610 Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header. CVSS 3.1MEDIUM 5.9
  • TI-2024-29381 Hono CSRF middleware can be bypassed using crafted Content-Type header CVSS 3.1MEDIUM 5.0
  • TI-2026-39189 Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest CVSS 3.1MEDIUM 4.8
  • TI-2026-23190 Hono: Arbitrary file access via serveStatic vulnerability CVSS 3.1CRITICAL 9.8
See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences