CVE-2026-118663

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118663", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-28T17:25:37.562Z", "datePublished": "2026-10-28T20:35:22.948Z", "dateUpdated": "2026-10-29T18:26:42.881Z"}, "containers": {"cna": {"title": "@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths", "problemTypes": [{"descriptions": [{"cweId": "CWE-174", "lang": "en", "description": "CWE-174: Double Decoding of the Same Data", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/honojs/node-server/security/advisories/GHSA-rmxm-3fg6-px4f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/honojs/node-server/security/advisories/GHSA-rmxm-3fg6-px4f"}, {"name": "https://github.com/honojs/node-server/commit/982179278529d5673812116b042829f27794966f", "tags": ["x_refsource_MISC"], "url": "https://github.com/honojs/node-server/commit/982179278529d5673812116b042829f27794966f"}, {"name": "https://github.com/honojs/node-server/releases/tag/v2.1.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/honojs/node-server/releases/tag/v2.1.3"}], "affected": [{"vendor": "honojs", "product": "node-server", "versions": [{"version": "> = 1.19.10, < 2.1.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T20:35:22.948Z"}, "descriptions": [{"lang": "en", "value": "@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file resolution uses a different directory. An unauthenticated attacker can bypass middleware mounted on a protected static prefix and read a file inside the configured static root, although the flaw does not permit traversal outside that root. This issue is fixed in version 2.1.3."}], "source": {"advisory": "GHSA-rmxm-3fg6-px4f", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-29T18:26:31.513669Z", "id": "CVE-2026-118663", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T18:26:42.881Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118663", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-28T17:25:37.562Z", "datePublished": "2026-10-28T20:35:22.948Z", "dateUpdated": "2026-10-29T18:26:42.881Z"}, "containers": {"cna": {"title": "@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths", "problemTypes": [{"descriptions": [{"cweId": "CWE-174", "lang": "en", "description": "CWE-174: Double Decoding of the Same Data", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/honojs/node-server/security/advisories/GHSA-rmxm-3fg6-px4f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/honojs/node-server/security/advisories/GHSA-rmxm-3fg6-px4f"}, {"name": "https://github.com/honojs/node-server/commit/982179278529d5673812116b042829f27794966f", "tags": ["x_refsource_MISC"], "url": "https://github.com/honojs/node-server/commit/982179278529d5673812116b042829f27794966f"}, {"name": "https://github.com/honojs/node-server/releases/tag/v2.1.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/honojs/node-server/releases/tag/v2.1.3"}], "affected": [{"vendor": "honojs", "product": "node-server", "versions": [{"version": "> = 1.19.10, < 2.1.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T20:35:22.948Z"}, "descriptions": [{"lang": "en", "value": "@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file resolution uses a different directory. An unauthenticated attacker can bypass middleware mounted on a protected static prefix and read a file inside the configured static root, although the flaw does not permit traversal outside that root. This issue is fixed in version 2.1.3."}], "source": {"advisory": "GHSA-rmxm-3fg6-px4f", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118663", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-29T18:26:31.513669Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T18:26:37.694Z"}}]}}

{"affected": [{"affectedData": [{"product": "node-server", "vendor": "honojs", "versions": [{"status": "affected", "version": "> = 1.19.10, < 2.1.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file resolution uses a different directory. An unauthenticated attacker can bypass middleware mounted on a protected static prefix and read a file inside the configured static root, although the flaw does not permit traversal outside that root. This issue is fixed in version 2.1.3."}], "id": "CVE-2026-118663", "lastModified": "2026-10-29T19:17:18.953", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118663", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-29T18:26:31.513669Z", "version": "2.0.3"}}]}, "published": "2026-10-28T21:16:56.543", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/honojs/node-server/commit/982179278529d5673812116b042829f27794966f"}, {"source": "security-advisories@github.com", "url": "https://github.com/honojs/node-server/releases/tag/v2.1.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/honojs/node-server/security/advisories/GHSA-rmxm-3fg6-px4f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-174"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "node-server: node-server: Security middleware bypass via double path decoding in serveStatic", "id": "2563641", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563641"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-551", "details": ["@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file resolution uses a different directory. An unauthenticated attacker can bypass middleware mounted on a protected static prefix and read a file inside the configured static root, although the flaw does not permit traversal outside that root. This issue is fixed in version 2.1.3.", "A flaw was found in node-server. This flaw allows an unauthenticated remote attacker to bypass route middleware, such as authentication checks, and access protected static files within the configured root directory. The vulnerability occurs because the static file serving function decodes request paths a second time after initial routing, causing specially crafted percent-encoded paths to bypass prefix-based security controls."], "name": "CVE-2026-118663", "public_date": "2026-10-28T20:35:22Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118663\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118663\nhttps://github.com/honojs/node-server/commit/982179278529d5673812116b042829f27794966f\nhttps://github.com/honojs/node-server/releases/tag/v2.1.3\nhttps://github.com/honojs/node-server/security/advisories/GHSA-rmxm-3fg6-px4f"], "statement": "This vulnerability is rated as Moderate because, while an unauthenticated remote user can bypass prefix-based middleware such as access controls, data exposure is strictly confined to files within the designated static root directory. The flaw does not permit arbitrary directory traversal beyond that root, nor does it affect system integrity or availability. Environments serving only publicly accessible static assets or those enforcing authentication at the reverse proxy level are not exposed to unauthorized disclosure.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.19.10,2.1.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "node-server", "source": "cna", "vendor": "honojs"}, "product": "node-server", "vendor": "hono"}], "created": "2026-10-28T21:44:23.840201+00:00", "updated": "2026-11-06T02:15:18.153524+00:00", "vendors": ["hono", "hono$PRODUCT$node-server"], "weaknesses": ["CWE-174", "CWE-551"]}