{"id":"ghsa-ghsa-rmxm-3fg6-px4f","seq":2056965,"kind":"advisory","title":"@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths","url":"https://github.com/advisories/GHSA-rmxm-3fg6-px4f","permalink":"https://vulnpulse.app/items/ghsa-ghsa-rmxm-3fg6-px4f","summary":"影響: npm:@hono/node-server >= 1.19.10, < 2.1.3 → 2.1.3\nserveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path once before routing. serveStatic decoded it again before resolving the file. With a malformed percent-encoded sequence, the first decode leaves part of the path encoded, the router matches the encoded form, and t…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-118663"],"tags":["GHSA-rmxm-3fg6-px4f","@hono/node-server"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:05:00.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}