CVE-2026-118663

What it actually does

Double URL decoding in serveStatic causes route middleware to see an encoded path while file resolution uses a decoded path, allowing bypass of middleware on protected static prefixes and unauthorized read access to files inside the static root without directory traversal.

Why it matters to the business

Attackers can read sensitive static files that should be protected by middleware, potentially exposing configuration, data, or other internal content with minimal effort.

How an attack unfolds

An unauthenticated attacker sends a request containing a malformed percent-encoded sequence targeting a static file path protected by middleware; the double-decoding discrepancy lets the request reach the static file handler while bypassing the middleware checks.

How to fix it

Upgrade @hono/node-server to version 2.1.3 or later; review and test all serveStatic middleware configurations after upgrade.

How to confirm the fix worked

Confirm the installed package version is 2.1.3 or newer; attempt previously successful bypass requests to verify middleware enforcement; scan dependency manifests for older vulnerable versions.

Typical attack path

1. Identify static routes protected by authentication or authorization middleware
2. Craft a request URL containing a malformed percent-encoded sequence for the desired file path
3. Send the request to the server
4. Receive the file contents that middleware should have blocked

How to detect it

Review web server access logs for requests containing repeated or malformed percent-encoding sequences targeting static file paths; correlate with middleware-protected routes.

What your security team should do

• Upgrade to version 2.1.3 immediately due to the recent disclosure
• Audit all applications using serveStatic for middleware-protected static paths
• Add web application firewall rules to block suspicious percent-encoded sequences in static paths
• Monitor logs for unusual encoding patterns in static file requests