@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

影響: npm:@hono/node-server >= 1.19.10, < 2.1.3 → 2.1.3

serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path once before routing. serveStatic decoded it again before resolving the file. With a malformed percent-encoded sequence, the first decode leaves part of the path encoded, the router matches the encoded form, and t…

GitHub Advisory Database에서 읽기

2026. 10. 29. 오전 06:05, GitHub Advisory Database에서 "@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-118663.