5.3

CVE-2026-118663: @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

Awaiting analysis
AliasesGHSA-rmxm-3fg6-px4fCGA-2v3v-fpff-fmm2CGA-3g2x-qvpm-9grv
Published 28-10-2026Last modified 29-10-2026

Vulnerability summary

CVE-2026-118663 is a medium (CVSS 5.3) Double Decoding of the Same Data vulnerability in honojs node-server. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 29% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.35%
0%100%
Low · Change unavailable
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Timeline

  1. 28-10-2026
    PublishedVulnerability first disclosed.
  2. 29-10-2026
    Last modifiedVulnerability information updated.

Description

@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file resolution uses a different directory. An unauthenticated attacker can bypass middleware mounted on a protected static prefix and read a file inside the configured static root, although the flaw does not permit traversal outside that root. This issue is fixed in version 2.1.3.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.35%

Chance of exploitation in the next 30 days

Percentile

29%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

29-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard15 products
  • kibana-9.2All versions (No fix recorded) | < 9.2.8-r32
  • langfuse-3< 3.225.15-r2
  • langfuse-3-worker< 3.225.15-r2 | All versions (No fix recorded)
  • langfuse-4All versions (No fix recorded)
  • langfuse-4-workerAll versions (No fix recorded)
Wolfi2 products
  • langfuse-3< 3.225.15-r2
  • langfuse-3-worker< 3.225.15-r2 | All versions (No fix recorded)
@hono1 product
  • node-server≥ 1.19.10, < 2.1.3
Honojs1 product

4 vendors · 19 products

References

6 links