PT-2026-23096 · Unknown · @Hono/Node-Server
Highyusuke
·
Published
2026-03-04
·
Updated
2026-05-18
·
CVE-2026-29087
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
@hono/node-server versions prior to 1.19.10
Description
@hono/node-server allows running the Hono application on Node.js. When using static file serving with route-based middleware protections, inconsistent URL decoding can allow protected static resources to be accessed without authorization. Paths containing encoded slashes (
%2F) may be evaluated differently by routing/middleware matching versus static file path resolution, enabling a bypass where middleware does not run but the static file is still served. The routing layer preserves %2F as a literal string when matching routes, while the static handler decodes %2F into / before resolving the filesystem path. This does not allow access outside the configured static root and is not a path traversal issue. An unauthenticated attacker could bypass route-based authorization protections for protected static resources by supplying paths containing encoded slashes. Applications relying solely on route-based middleware to protect static subpaths under the same static root may have exposed those resources.Recommendations
Versions prior to 1.19.10 should be updated to version 1.19.10 or later.
Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
@Hono/Node-Server